GAO 



United States Government Accountability Office 



Report to Congressional Requesters 



se«oo 9 HIGH-CONTAINMENT 

LABORATORIES 



National Strategy for 
Oversight Is Needed 




GAP 

Accountability * Integrity * Reliability 



GAO-09-574 



September 2009 



G A O 



Accountability Integrity Reliability 

Highlights 

Highlights of GAO-09-574, a report to 
congressional requesters 



HIGH-CONTAINMENT LABORATORIES 
National Strategy for Oversight Is Needed 



Why GAO Did This Study 

U.S. laboratories working with 
dangerous biological pathogens 
(commonly referred to as high- 
containment laboratories) have 
proliferated in recent years. As a 
result, the public is concerned 
about the oversight of these 
laboratories. The deliberate or 
accidental release of biological 
pathogens can have disastrous 
consequences. 

GAO was asked to determine (1) to 
what extent, and in what areas, the 
number of high-containment 
laboratories has increased in the 
United States, (2) which federal 
agency is responsible for tracking 
this expansion and determining the 
associated aggregate risks, and (3) 
lessons learned from highly 
publicized incidents at these 
laboratories and actions taken by 
the regulatory agencies. 

To carry out its work, GAO 
surveyed and interviewed federal 
agency officials, (including relevant 
intelligence community officials), 
consulted with experts in 
microbiology, reviewed literature, 
conducted site visits, and analyzed 
incidents at high-containment 
laboratories. 



What GAO Recommends 



GAO is recommending that (1) the 
National Security Advisor name an 
entity charged with government- 
wide strategic evaluation of high- 
containment laboratories and (2) 
the Secretaries of Health and 
Human Services and Agriculture 
address specific oversight issues 
regarding high-containment 
laboratories. The Secretaries of 
Health and Human Services and 
Agriculture agreed with our 
recommendations relevant to them. 



View GAO-09-574 or key components. 
For more information, contact Nancy 
Kingsbury at (202) 512-2700 or 
kingsburyn@gao.gov. 



What GAO Found 

The recent expansion of high-containment laboratories in the United States began 
in response to the need to develop medical countermeasures after the anthrax 
attacks in 2001. Understandably, the expansion initially lacked a clear, 
governmentwide coordinated strategy. In that emergency situation, the 
expansion was based on individual agency perceptions of the capacity their high- 
containment labs required as well as the availability of congressionally approved 
funding. Decisions to fund the construction of high-containment labs were made 
by multiple federal agencies in multiple budget cycles. Federal and state agencies, 
academia, and the private sector considered their individual requirements, but an 
assessment of national needs was lacking. Even now, after more than 7 years, 
GAO was unable to find any projections based on a governmentwide strategic 
evaluation of future capacity requirements set in light of existing capacity; the 
numbers, location, and mission of the laboratories needed to effectively counter 
biothreats; and national public health goals. Such information is needed to 
ensure that the United States will have facilities in the right place with the right 
specifications. 

Furthermore, since no single agency is in charge of the expansion, no one is 
determining the aggregate risks associated with this expansion. As a 
consequence, no federal agency can deterrriine whether high-containment 
laboratory capacity may now meet or exceed the national need or is at a level 
that can be operated safely. If an agency were tasked, or a mechanism were 
established, with the purpose of overseeing the expansion of high-containment 
laboratories, it could develop a strategic plan to (1) ensure that the numbers 
and capabilities of potentially dangerous high-containment laboratories are no 
greater than necessary, (2) balance the risks and benefits of expanding such 
laboratories, and (3) determine the type of oversight needed. 

Four highly publicized incidents in high-containment laboratories, as well as 
evidence in scientific literature, demonstrate that (1) while laboratory 
accidents are rare, they do occur, primarily due to human error or systems 
(management and technical operations) failure, including the failure of safety 
equipment and procedures, (2) insiders can pose a risk, and (3) it is difficult to 
control inventories of biological agents with currently available technologies. 
Taken as a whole, these incidents demonstrate failures of systems and 
procedures meant to maintain biosafety and biosecurity in high-containment 
laboratories. For example, they revealed the failure to comply with regulatory 
requirements, safety measures that were not commensurate with the level of 
risk to public health posed by laboratory workers and pathogens in the 
laboratories, and the failure to fund ongoing facility maintenance and monitor 
the operational effectiveness of laboratory physical infrastructure. 

Oversight plays a critical role in improving biosafety and ensuring that high- 
containment laboratories comply with regulations. However, some aspects of the 
current oversight programs provided by the Departments of Health and Human 
Services and Agriculture are dependent upon entities monitoring themselves and 
reporting incidents to federal regulators. Since 2001, personnel reliability 
programs have been established to counter insider risks, but their cost, 
effectiveness, and impact has not been evaluated. 
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4 GAP 

— Accountability * Integrity * Reliability 

United States Government Accountability Office 
Washington, DC 20548 



September 21, 2009 
Congressional Requesters 

Across the United States, federal and state agencies, industries, and 
academic institutions are building biosafety level (BSL)-3 and BSL-4 
laboratories — commonly referred to as high-containment laboratories — to 
research dangerous pathogens (which might accidentally or intentionally 
be released into the environment) and emerging infectious diseases for 
which risks may not be clearly understood. 1 The recent increase in the 
number of high-containment laboratories is primarily due to the U.S. 
government's burgeoning biodefense research programs following the 
2001 anthrax attacks — totaling $1 billion annually for new research. 2 
According to the National Institute of Allergy and Infectious Diseases 
(NIAID), these high-containment laboratories were needed to support its 
research agenda for developing medical countermeasures against 
biothreats. Scientific research on these dangerous pathogens and the 
mechanisms by which they cause disease underpins the nation's ability to 
successfully combat infectious diseases and is essential to the 
development of new and improved diagnostics, treatments, and preventive 
measures for a variety of infectious diseases. 



'Some use the term high- and maximum-containment laboratories to refer to BSL-3 and 
BSL-4 laboratories. The terms animal biosafety level (ABSL)-3 and ABSL-4 are used for 
laboratories that work with animals infected with indigenous or exotic agents. The term 
BSL-3 Ag is used to describe laboratories where studies are conducted employing large 
agricultural animals. However, for purposes of this report, we are using the term high- 
containment laboratories to refer to all these laboratories. 

2 In the wake of the 2001 terrorist attacks, the National Institutes of Health (NIH) convened 
the Blue Ribbon Panel on Bioterrorism and Its Implications for Biomedical Research. 
Based on the panel's advice, NIH developed three key documents to guide its biodefense 
research program; these are the NIAID Strategic Plan for Biodefense Research, the NIAID 
Research Agenda for Category A Agents (covering agents that pose the gravest threat to 
human health, such as those that cause smallpox, anthrax, botulism, and plague), and the 
NIAID Research Agenda for Category B and C Agents (for agents whose biological 
properties make them more difficult to deploy or less likely to cause widespread harm than 
Category A agents). The strategic plan provided a blueprint to construct three essential 
pillars of the biodefense research program: (1) infrastructure needed to safely conduct 
research on dangerous pathogens; (2) basic research on microbes and host immune 
defenses, which serves as the foundation for applied research; and (3) targeted, milestone- 
driven medical countermeasure development to create the vaccines, therapeutics, and 
diagnostics that will be needed in the event of a bioterror attack. To implement the 
biodefense agendas, Congress increased NIH appropriations for biodefense research from 
$53 million in fiscal year 2001 to $1.5 billion in fiscal year 2003 and approximately $1.7 
billion in fiscal year 2005. 
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In 2007, we reported on issues associated with the proliferation of high- 
containment laboratories in the United States, including risks posed by 
biosafety incidents that have occurred in the past. 3 The Federal Bureau of 
Investigation's (FBI) allegation in August 2008 that a scientist at the U.S. 
Army Medical Research Institute of Infectious Diseases (USAMRIID) was 
the sole perpetrator of the 2001 anthrax attacks raised additional concerns 
about the possibility of insider misuse of high-containment laboratory 
facilities, material, and technology. The public is concerned about these 
laboratories because the deliberate or accidental release of biological 
agents can have disastrous consequences by exposing workers and the 
public to dangerous pathogens. Highly publicized laboratory errors and 
controversies about where high-containment laboratories should be 
located have raised questions about whether the governing framework, 
oversight, and standards for biosafety and biosecurity measures are 
adequate. 4 In this context, you asked us to address the following 
questions: 5 

1. To what extent, and in what areas, has the number of high- 
containment laboratories increased in the United States? 

2. Which federal agency is responsible for tracking the expansion of high- 
containment laboratories and determining the associated aggregate 
risks? 

3. What lessons can be learned from highly publicized incidents at high- 
containment laboratories and actions taken by the regulatory 
agencies? 

To answer these questions, we interviewed federal agency officials as well 
as experts in microbiology, reviewed literature, conducted site visits, and 
surveyed 12 federal agencies to determine if they have a mission to track 
high-containment laboratories in the United States. We also interviewed 
officials from relevant intelligence agencies to determine if they have a 
mission to determine insider risks in high-containment laboratories. The 



3 GAO, High-Containment Biosafety Laboratories: Preliminary Observations on the 
Oversight of the Proliferation of BSL-3 and BSL-4 Laboratories in the United States, 
GAO-08-108T (Washington, D.C.: Oct. 4, 2007). 

4 G.K. Gronvall et. at, "Letter to Senator Edward Kennedy and Senator Richard Burr," 
Center for Biosecurity, University of Pittsburgh Medical Center, March 3, 2009. 

The request letter contained several questions. In agreement with our requester, we 
revised the questions as stated. 
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expert panel (see appendix II) that reviewed this report comprised 
scientists with substantive expertise in microbiological and select agent 
research and the operation of high-containment laboratories. 

We conducted our work from September 2005 through June 2009 in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. (See appendix I for our scope and 
methodology and appendix II for a list of the experts who reviewed this 
report.) 



Background 



Level of Risk in High- In the life sciences, biosafety is a combination of the containment 

Containment Laboratories principles, technologies, practices, and procedures that are implemented 

to prevent the unintentional exposure to pathogens and toxins or their 
accidental release. In most countries, infectious agents are classified by 
risk group. Agent risk group classification emphasizes the potential risk 
and consequences of (1) exposure and infection for the laboratory worker 
or (2) the release of the agent into the environment with subsequent 
exposure of the general population. 

Risk group classification considers aspects of a given pathogen, in 
particular its infectivity; mode and ease of transmission; pathogenicity and 
virulence (including induced morbidity and case-fatality rate); 
susceptibility to physical or chemical agents; and the availability or 
absence of countermeasures, including vaccines, therapeutic remedies, 
and cures. Depending on the risk group classification, research on 
infectious agents is to be performed in facilities offering varying levels of 
containment, applying different types of primary containment protection 
(for example, biological safety cabinets), and ensuring that appropriate 
practices and procedures are in place. 



In the United States, laboratories working with human pathogens are 
classified by the type of agents used; activities being conducted; and the 
risks those agents pose to laboratory personnel, the environment, and the 
community. The Department of Health and Human Services (HHS) has 



Biosafety Levels for 
Laboratories Working with 
Human Pathogens 
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developed and provided biosafety guidelines outlined in the manual titled 
Biosafety in Microbiological and Biomedical Laboratories (BMBL). 6 This 
manual provides guidelines for work at four biosafety levels, with BSL-4 
being the highest. The NIH Guidelines for Research Involving 
Recombinant DNA Molecules (NIH rDNA Guidelines) 7 similarly describe 
four levels of biocontainment that closely parallel those described in the 
BMBL. The NIH rDNA Guidelines apply to all research involving 
recombinant DNA at institutions that receive any NIH funding for such 
research. 

Biosafety level designations, as defined in the BMBL, refer to levels of 
containment rather than categories of facilities. These levels of 
containment requirements could change from day to day depending on the 
risk of the work being conducted with particular agents. For example, 
BSL-2 practices are recommended for diagnostic work with B. anthracis, 
but BSL-3 practices are recommended for higher-risk work with B. 
anthracis, such as aerosol challenges. Table 1 shows the different 
biosafety levels specified in the guidelines for laboratories working with 
human pathogens. 



Department of Health and Human Services (Washington, D.C., 2007), Biosafety in 
Microbiological and Biomedical Laboratories, 5th ed. 

department of Health and Human Services, (Washington, D.C., 2002) NIH Guidelines for 
Research Involving Recombinant DNA Molecules. 



Page 4 



GAO-09-574 High-Containment Laboratories 



Table 1 : Recommended Biosafety Levels for Laboratories Working with Human Pathogens 



Biosafety 
level 


Agent 


Practices 


Primary barriers and 
safety equipment 


Facilities (secondary 
barriers) 


1 


Not known to consistently 
cause diseases in healthy 
adults 


Standard microbiological 
practices 


None required 


Laboratory bench and sink 
required 



Agents associated with 
human disease 

Routes of transmission 
include percutaneous 
injury, ingestion, and 
mucous membrane 
exposure 



BSL-1 practice plus 
limited access 
biohazard warning 
signs 

"sharps" precaution 

biosafety manual 
defining any needed 
waste decontamination 
or medical surveillance 
policies 



Primary barriers: 

class I or II biosafety 
cabinets (BSC) or other 
physical containment 
devices used for all 
manipulations of 
agents that cause 
splashes or aerosols of 
infectious materials 

Personal protective 
equipment (PPE): 

laboratory coats, 
gloves, and face 
protection as needed 



BSL-1 plus 

autoclave" available 



Indigenous or exotic 
agents with potential 
for aerosol 
transmission 



BSL-2 practice plus 

controlled access 

decontamination of all 
waste 

decontamination of 
laboratory clothing 
before laundering 

baseline serum 



Primary barriers: 

class I or II BSCs or 
other physical 
containment devices 
used for all open 
manipulation of agents 

PPE: 

protective laboratory 
clothing, gloves, and 
respiratory protection 
as needed 



BSL-2 plus 

physical separation 
from access corridors 

self-closing, double- 
door access 

exhaustair not 
recirculated 

negative airflow into 
laboratory 



Dangerous exotic 
agents that pose a high 
risk of life-threatening 
disease 

Aerosol-transmitted 
laboratory infections 
have occurred; or 
related agents with 
unknown risk of 
transmission 



BSL-3 practices plus 

clothing change before 
entering 

shower on exit 

all material 

decontaminated on exit 
from facility 



Primary barriers: 

all procedures 
conducted in class III 
BSCs or class I or II 
BSCs in combination 
with full-body, air- 
supplied positive 
pressure personnel unit 



BSL-3 plus 

separate building or 
isolated zone 

dedicated supply and 
exhaust, vacuum, and 
decontamination 
systems 

other requirements 
outlined in the BMBL 
text 



Source: BMBL, 5th edition. 

a An autoclave is a device to sterilize equipment and supplies by subjecting them to high-pressure 
steam at 121° C or higher. 
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The levels refer to a combination of laboratory practices and procedures, 
safety equipment, and facilities that are recommended for laboratories that 
conduct research on these pathogenic agents and toxins. These 
laboratories are to be designed, constructed, and operated to (1) prevent 
accidental release of infectious or hazardous agents within the laboratory 
and (2) protect laboratory workers and the environment external to the 
laboratory, including the community, from exposure to the agents. 

Work in BSL-3 laboratories involves agents that may cause serious and 
potentially lethal infection. In some cases, vaccines or effective treatments 
are available. Types of agents that are typically handled in BSL-3 
laboratories include B. anthracis (which causes anthrax), West Nile Virus, 
Coxiella burnetti (which causes Q fever), Francisella tularensis (which 
causes tularemia), and highly pathogenic avian influenza virus. Work in 
BSL-4 laboratories involves exotic agents that pose a high individual risk 
of life-threatening disease or aerosol transmission or related agents with 
unknown risks of transmission. Agents typically handled in BSL-4 
laboratories include the Ebola virus, Marburg virus, and Variola major 
virus. 8 



Animal Biosafety Level Just as laboratories working with human pathogens are classified by BSLs 

Criteria for Vertebrate 1-4, laboratories working with naturally infected vertebrate animals are 

Animals classified by animal biosafety levels (ABSL) 1-4. The four ABSLs describe 

facilities and practices applicable to work with animals infected with 
agents assigned to biosafety levels 1-4, respectively. The recommendations 
describe four combinations of practices, procedures, safety equipment, 
and facilities for experiments with animals involved in infectious disease 
research and other studies that may require containment. Table 2 shows 
the different ABSLs specified in the guidelines for laboratories working 
with vertebrate animals. 



Variola major virus, by international agreement, can only be worked on in two specific 
facilities in the world. 
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Table 2: Recommended Biosafety Levels for Activities in Which Experimentally or Naturally Infected Vertebrate Animals Are 
Used 



ABSL Agents 



Practices 



Primary barriers and safety 
equipment 



Facilities (secondary 
barriers) 



Not known to consistently 
cause diseases in healthy 
adults 



Standard animal care and 
management practices, 
including appropriate medical 
surveillance programs 



As required for normal care of 
each species 



Standard animal facility: 

no recirculation of 
exhaust air 

directional air flow 
recommended 

hand washing sink is 
available 



Associated with human 
disease 

Hazard: percutaneous 
exposure, ingestion, or 
mucous membrane 
exposure. 



ABSL-1 practice plus: 

limited access 

biohazard warning signs 

"sharps" precautions 

biosafety manual 

decontamination of all 
infectious wastes and 
animal cages prior to 
washing 



ABSL-1 equipment plus 
primary barriers: 

containment equipment 
appropriate for animal 
species 

Personal protective 
equipment (PPE) 

laboratory coats, gloves, 
face and respiratory 
protection as needed 



ABSL-1 plus: 

autoclave available 
hand washing sink 
available 

mechanical cage washer 
recommended 



Indigenous or exotic 
agents with potential for 
aerosol transmission 

Disease may have 
serious health effects 



ABSL-2 practice plus: 

controlled access 

decontamination of 
clothing before 
laundering 

cages decontaminated 
before bedding removed 

disinfectant foot bath as 
needed 



ABSL-2 equipment plus: 

containment equipment 
for housing animals and 
cage dumping activities 

class I, II, or III biosafety 
cabinets (BSC) available 
for manipulative 
procedures (inoculation, 
necropsy) that may 
create infectious 
aerosols. 



ABSL-2 facility plus: 

physical separation from 
access corridors 

self-closing, double-door 
access 

sealed penetrations 

sealed windows 

autoclave available in 
facility 



PPEs: 



appropriate respiratory 
protection 



Dangerous/exotic agents 
that pose high risk of life- 
threatening disease 

Aerosol transmission or 
related agents with 
unknown risk of 
transmission 



ABSL-3 practices plus: 

entrance through change 
room where personal 
clothing is removed and 
laboratory clothing is put 
on; shower on exiting 

all wastes are 
decontaminated before 
removal from the facility 



ABSL-3 equipment plus: 
maximum containment 
equipment (i.e., class III 
BSC or partial 
containment equipment 
in combination with full 
body, air-supplied 
positive-pressure 
personnel suit) used for 
all procedures and 
activities 



ABSL-3 facility plus: 

separate building or 
isolated zone 

dedicated supply and 
exhaust, vacuum, and 
decontamination systems 

other requirements 
outlined in the text 



Legend: ABSL =animal biosafety level 

Source: BMBL, 5th edition. 
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Agricultural Biosafety 
Levels 



According to the BMBL, risk assessment and management guidelines for 
agriculture differ from human public health standards. Risk management 
for agricultural research is based on the potential economic impact of 
animal and plant morbidity and mortality, and the trade implications of 
disease. Worker protection is important, but greater emphasis is placed on 
reducing the risk of the agent escaping into the environment. Biosafety 
level-3 Agriculture (BSL-3Ag) is unique to agriculture because of the 
necessity to protect the environment from a high consequence pathogen in 
a situation where studies are conducted employing large agricultural 
animals or other similar situations in which the facility barriers serve as 
primary, rather than secondary, containment. BSL-3Ag facilities are 
specially designed, constructed, and operated at a unique containment 
level for research involving certain biological agents in large animal 
species. BSL-3Ag facilities are specifically designed to protect the 
environment by including almost all of the features ordinarily used for 
BSL-4 facilities as enhancements. All BSL-3Ag containment spaces must be 
designed, constructed, and certified as primary containment barriers. The 
Department of Agriculture's Animal and Plant Health Inspection Service 
(APHIS) may require enhancements beyond BSL-3/ABSL-3 when working 
in the laboratory or vivarium with certain veterinary agents of concern. 9 



The NIH rDNA Guidelines provide containment standards for research 
involving rDNA and animals that are of sizes or have growth requirements 
that preclude the use of laboratory containment. 



Containment Levels for 
Plants 



Currently, the BMBL does not provide any comparable classification levels 
for laboratories working with plant pathogens. 



Federal Agency 
Involvement in High- 
Containment Laboratories 
and Related Issues 



Many different federal agencies are involved with BSL-3 and BSL-4 
laboratories in the United States in various capacities-they may be users, 
owners, regulators, or funding sources. 10 Examples include the following: 



A vivarium is an indoor enclosure for keeping and raising living animals and plants and 
observing them under natural conditions. 

10 Some of the federal agencies, such as the Department of Commerce and the Department 
of Transportation, help regulate the transport of hazardous biological agents and toxins 
that high-containment laboratories handle. 
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• The Centers for Disease Control and Prevention (CDC) has its own high- 
containment laboratories. The Division of Select Agents and Toxins 
(DSAT), located within the Coordinating Office for Terrorism 
Preparedness and Emergency Response at CDC, regulates federal, state, 
academic, commercial, and private laboratories throughout the United 
States that possess, use, or transfer select agents. 11 CDC also funds some 
laboratory activities carried out in state public health laboratories, 
commonly referred to as the Laboratory Response Network (LRN). 12 

• The Department of Agriculture (USDA) has its own laboratories, and 
APHIS regulates laboratories working with select agents and toxins posing 
a risk to animal and plant health or animal and plant products. 

• The National Institutes of Health (NIH), working through its various 
institutes, funds biomedical research, some of which requires high 
containment laboratories. NIH has containment and biosafety 
requirements that apply to this and other research that it funds when the 
research uses recombinant deoxyribonucleic acid (rDNA) molecules. The 
NIH rDNA Guidelines provide greenhouse containment standards for 
rDNA-containing plants, as well as plant-associated microorganisms and 
small animals. NIH has its own high-containment laboratories and has 
funded the construction of high-containment laboratories at academic 
institutions. 

• The Food and Drug Administration (FDA) has its own laboratories and 
regulates manufacturing of biological products, some of which require 
high-containment laboratories. 



Select agents are biological agents and toxins (1) that have the potential to pose a severe 
threat to public health and safety, to animal or plant health, or to animal or plant products 
and (2) whose possession, use, and transfer are regulated by select agent rules (7 C.F.R. 
Part 331, 9 C.F.R. Part 121, and 42 C.F.R. Part 73). The CDC and USDA maintain a list of 
select agents and toxins. 

12 The LRN was established by the Department of Health and Human Services, Centers for 
Disease Control and Prevention (CDC), in accordance with Presidential Decision Directive 
39, which outlined national antiterrorism policies and assigned specific missions to federal 
departments and agencies. Through collaborative efforts involving LRN founding partners, 
the FBI, and the Association of Public Health Laboratories, the LRN became operational in 
October 1999. Its objective was to ensure an effective laboratory response to bioterrorism 
by helping to improve the nation's public health laboratory infrastructure. Several years 
later, the capcaity to respond to chemical terrorism was developed. 
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• The Department of Commerce regulates the export of agents and 
equipment that have both military and civilian uses and that are often 
found in high-containment laboratories. 

• The Department of Defense (DOD) has its own laboratories and funds 
research requiring high-containment laboratories. 

• The Department of Labor's Occupational Safety and Health Administration 
(OSHA) regulates and inspects private-sector employee safety and health 
within high-containment biological laboratories and regulates federal 
employee safety and health in these laboratories. However, OSHA does not 
have statutory responsibility for the occupational safety and health of (1) 
contractor employees performing work at government-owned, contractor- 
operated sites owned by the Department of Energy (DOE) or (2) state and 
local government employees. 

• The Department of State (DOS) regulates the export of agents and 
equipment from defense-related high-containment laboratories. DOS also 
maintains a listing of some high-containment laboratories as part of U.S. 
commitments under the Biological and Toxin Weapons Convention. 

• The Department of Justice's (DOJ) Federal Bureau of Investigation (FBI) 
utilizes high-containment laboratories when its forensic work involves 
dangerous biological agents and conducts security risk assessments for 
the DSAT and APHIS select agent programs. 

• The Department of Homeland Security (DHS) has its own high- 
containment laboratories and funds a variety of research requiring high- 
containment laboratories. 

• The Department of Energy (DOE) has several BSL-3 laboratories doing 
research to develop detection and response systems to improve 
preparedness for a biological attack. 

• The Department of the Interior has its own BSL-3 laboratories for work 
with infectious animal diseases. 

• The Department of Veterans Affairs has BSL-3 laboratories for diagnostic 
and research purposes. 

• The Environmental Protection Agency (EPA) has its own BSL-3 
laboratories and also coordinates the use of various academic, state, and 
commercial high-containment laboratories nationwide as part of its 
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emergency response mission (eLRN, environmental laboratory Response 
Network). 



Laws, Regulations, and 
Guidance Pertinent to 
High-Containment 
Laboratories 



Pertinent Laws 



Currently, no U.S. laws provide for federal government oversight of all 
high-containment laboratories. However, laws regulating the use, 
possession, and transfer of select agents and toxins impose requirements 
on entities with high-containment laboratories that work with these 
agents. 13 The following is a short summary of pertinent laws, regulations, 
and guidance. 

Following the Oklahoma City bombing in 1995, Congress passed the 
Antiterrorism and Effective Death Penalty Act of 1996 to deter terrorism, 
among other reasons. 14 Section 511 of title V of this act gave authority to 
the HHS Secretary to regulate the transfer, between laboratories, of 
certain biological agents and toxins. It directed the Secretary to 
promulgate regulations identifying a list of biological agents and toxins — 
called select agents — that have the potential to pose a severe threat to 
public health and safety, providing procedures governing the transfer of 
those agents, and establishing safeguards to prevent unauthorized access 
to those agents for purposes of terrorism or other criminal activities. In 
response to this act, the HHS Secretary established the select agent 
program within the CDC. 

In reaction to the September 11, 2001, terrorist attacks and the subsequent 
anthrax incidents, Congress passed several laws to combat terrorism (to 
prevent theft, unauthorized access, or illegal use) and, in doing so, 
significantly strengthened the oversight and use of select agents. The USA 
PATRIOT Act 15 made it a criminal offense for certain restricted persons — 
including some foreign aliens, persons with criminal records, and those 
with mental defects — to transport or receive select agents. The act also 
made it a criminal offense for any individual to knowingly possess any 
biological agent, toxin, or delivery system in type or quantity not justified 
by a peaceful purpose. Subsequently, Congress passed the Public Health 



Other laws regulate the transfer of various non-select agents that could originate in or be 
sent to high-containment laboratories. We do not discuss these regulations as they are not 
directly pertinent to high-containment laboratories. 

14 Pub. L. No. 104-132, 110 Stat. 1214, 1284 (April 24, 1996). 

15 United and Strengthening America by Providing Appropriate Tools Required to Intercept 
and Obstruct Terrorism Act of 2001, Pub. L. No. 107-56, 115 Stat. 271, 386 (Oct. 26, 2001). 
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Security and Bioterrorism Preparedness and Response Act of 2002 
(Bioterrorism Act), 16 which (1) expanded the select agent program to 
include not only the regulation of the transfer but also the use and 
possession of select agents and (2) increased safeguards and security 
requirements. 

The Bioterrorism Act expanded the select agent program by 

• granting comparable regulatory authorities to USDA for biological agents 
and toxins that present a severe threat to plant or animal health or plant or 
animal products; 17 

• requiring coordination/concurrence between USDA and HHS on select 
agents and toxins regulated by both agencies ("overlap" agents and 
toxins); 

• requiring the Secretaries of USDA and HHS to establish and maintain a list 
of each biological agent and toxin (select agent and toxin) that has the 
potential to pose a severe threat to public health and safety, animal or 
plant health, or animal or plant products and directing the Secretaries of 
HHS and Agriculture to biennially review and republish the select agent 
list, making revisions as appropriate to protect the public; 

• requiring the Secretaries by regulation to provide for registration of 
facilities for the possession, use, and transfer of select agents and toxins, 
not just for those facilities sending or receiving select agents; 

• requiring the Attorney General (delegated to the FBI's Criminal Justice 
Information Services Division) to check criminal, immigration, national 
security, and other electronic databases with information submitted in the 
registration process for all individuals and nongovernmental entities to 
determine if the registrant is a restricted person as defined in the USA 
PATRIOT Act or has been reasonably suspected by federal law 
enforcement or intelligence agencies of committing a federal crime of 
terrorism or having known involvement in an organization that engages in 
terrorism or is an agent of a foreign power (this is called a security risk 
assessment); 



"Pub. L. No. 107-188, 116 Stat. 594, 637-662 (June 12, 2002). 

"Subtitle B, of title II, of the Bioterrorism Act provides regulatory authority over select 
agents and toxins to the Secretary of Agriculture. This subtitle is cited as the Agricultural 
Bioterrorism Protection Act of 2002 (Agricultural Bioterrorism Act). 
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• requiring the Secretaries to establish a national database that includes the 
names and locations of registered entities; the lists of agents and toxins 
such entities possess, use, or transfer; and information regarding the 
characterizations of such agents and toxins; 

• requiring the Secretaries to promulgate regulations that include safeguard 
and security requirements for persons possessing, using, or transferring a 
select agent or toxin commensurate with the risk such an agent or toxin 
poses to public, animal, and plant health and safety, including required 
notification to the Secretaries and law enforcement agencies of theft, loss, 
or release of a listed agent or toxin; and 

• establishing civil money penalties for persons violating the regulations and 
additional criminal penalties for knowingly possessing a select agent or 
toxin without registering it or knowingly transferring a select agent or 
toxin to an unregistered person. 

(See appendix III for the list of select agents and toxins as of November 
11, 2008.) 

Pertinent Regulations and Select Agent Program Regulations 

Guidance 

HHS originally established the select agent program within CDC in 
response to the Antiterrorism and Effective Death Penalty Act of 1996. 
Before the select agent program was created, CDC regulated only the 
importation of etiologic agents. CDC published regulations governing the 
select agent program that became effective on April 15, 1997. These 
regulations provided additional requirements for facilities transferring or 
receiving select agents and specifically (1) established a list of select 
agents that have the potential to pose a severe threat to public health and 
safety, (2) required registration of facilities before the domestic transfer of 
select agents can occur, and (3) developed procedures to document the 
transfer of agents. 18 

Subsequently, the Bioterrorism Act strengthened HHS's authority to 
regulate facilities and individuals that possessed biological agents and 
toxins that pose a severe threat to public health and safety, and the 
Agricultural Bioterrorism Act granted comparable authority to the USDA 
to establish a parallel set of requirements for facilities and individuals that 
handle agents and toxins that pose a severe threat to animal or plant 



18 61 Fed. Reg. 55190 (Oct. 24, 1996). 
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health or animal or plant products. USDA delegated its authority to the 
Animal and Plant Health Inspection Service (APHIS). Both CDC and 
APHIS issued similar regulations governing the select agent program; 
these regulations became effective on April 18, 2005. 19 CDC issued 
regulations for select agents posing a threat to public health and safety. 
APHIS issued separate but largely identical regulations for select agents 
posing a threat to plants and animals. CDC and APHIS share 
oversight/registration responsibilities for overlap select agents that pose 
threats to both public health and animal health and animal products. 

In developing a list of select agents and toxins that have the potential to 
pose a severe threat to public health and safety, the HHS Secretary was 
required by the Bioterrorism Act to consider the criteria listed below. The 
Secretary directed the CDC to convene an interagency working group to 
determine which biological agents and toxins required regulation based on 
the following criteria: 

• the effect on human health of exposure to the agent or toxin; 

• the degree of contagiousness of the agent or toxin and the methods by 
which the agent or toxin is transferred to humans; 

• the availability and effectiveness of pharmacotherapies and immunizations 
to treat and prevent any illness resulting from infection by the agent or 
toxin; and 

• any other criteria, including the needs of children or other vulnerable 
populations, that the Secretary considers appropriate. 

Similarly, the Agricultural Bioterrorism Act required the USDA Secretary 
(delegated to APHIS) to consider the following criteria when selecting 
biological agents to be included in the list of select agents that pose a 
severe threat to animal or plant health or animal or plant products: 

• the effect of exposure to the agent or toxin on animal or plant health and 
on the production and marketability of animal or plant products; 

• the pathogenicity of the agent or the toxicity of the toxin and the methods 
by which the agent or toxin is transferred to animals and plants; 



1S 42 C.F.R. Part 73 (CDC); 7 C.F.R. Part 331 (APHIS-plant); 9 C.F.R. Part 121 (APHIS- 
animal). 
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• the availability and effectiveness of pharmacotherapies and prophylaxis to 
treat and prevent any illness caused by an agent or toxin; and 

• any other criteria that the Secretary considers appropriate to protect 
animal or plant health, or animal or plant products. 

Individuals and entities are required to register with CDC or APHIS prior 
to possessing, using, or transferring any select agents or toxins. Prior to 
registering, entities must designate a responsible official who has the 
authority and responsibility to act on behalf of the entity. Receiving a 
certificate of registration from the HHS Secretary or the Administrator of 
APHIS is contingent on CDC's or APHIS's review of the application 
package (APHIS/CDC Form 1) and the security risk assessment conducted 
by the FBI (composed of database checks and consisting of a report of 
criminal convictions and involuntary commitments greater than 30 days 
only) on the individual or nongovernmental entity (federal, state, or local 
governmental entities are exempt), the responsible official, and any 
individual who owns or controls the nongovernmental entity. Registration 
may also be contingent upon inspection of the facility. Submission of 
additional information — such as a biosecurity, biosafety, 20 or incident 
response plan — is required prior to receiving a certificate of registration. 
Registration is valid for one physical location and for a maximum of 3 
years. 

For facilities registered with CDC or APHIS that possess, use, or transfer 
select agents, the regulations require the following: 

1. All individuals in the facility needing access to select agents and toxins 
must be approved by the Administrator of APHIS or the HHS Secretary 
following a security risk assessment by the FBI prior to having access 
(access approval is valid for 5 years). 

2. The facility must develop and implement a written security plan 
sufficient to safeguard the select agent or toxin against unauthorized 
access, theft, loss, or release. 



The terms biosafety and biosecurity are sometimes used interchangeably; however, they 
are different. In this report, biosafety refers to practices employed to lower the risk of 
accidental release of dangerous pathogens in the laboratory or environmental release from 
the laboratory, while biosecurity refers to steps taken to secure pathogens from theft, 
unauthorized access, or illegal use. 
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3. The facility must develop and implement a written biosafety plan 
commensurate with the risk of the agent or toxin; the plan must 
contain sufficient information on biosafety and containment 
procedures. 

4. The facility must develop and implement a written incident response 
plan that fully describes the facility's response procedures for the 
theft, loss, or release of a select agent or toxin; inventory 
discrepancies; security breaches; severe weather; workplace violence; 
bomb threats; suspicious packages; and other possible emergencies at 
the facility. 

5. The facility must provide training on biosafety and security to 
individuals with access to select agents and to individuals not 
approved for access who will work in or visit areas where select 
agents or toxins are handled and stored. 

6. The facility must maintain records relating to the activities covered by 
the select agent regulations. 

7. The facility must immediately notify CDC or APHIS and appropriate 
federal, state, or local law enforcement agencies upon discovering a 
theft or loss of a select agent or toxin, and notify CDC or APHIS upon 
discovering the release of a select agent or toxin. 

As a matter of policy, CDC or APHIS inspects the premises and records of 
applicants, including a review of all required plans, before issuing the 
initial certificate of registration to ensure that the entity is compliant with 
the select agent regulations. Also, CDC and APHIS must be allowed to 
inspect, without prior notification, any facility where select agents or 
toxins are possessed, used, or transferred. CDC and APHIS perform site 
visits in cases where an entity may be adding a select agent or toxin, new 
laboratory facility, or new procedure that requires verification of the 
entity's biosafety plans and procedures. Other inspections performed by 
CDC and APHIS include follow-up inspections based on observations from 
audits performed by federal partners, compliance inspections, and 
investigations of reported incidents that may have involved biosafety or 
security concerns that could affect public, animal, and plant health and 
safety. CDC and APHIS use specific checklists to guide their inspections. 
CDC and APHIS developed these checklists from the select agent 
regulations and the BMBL, and they are available at 
www.selectagents.gov. The BMBL has become the code of practice for 
laboratory principles, practices, and procedures. 
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If CDC or APHIS discovers possible violations of the select agent 
regulations, several types of enforcement actions may occur: 

• Administrative actions: CDC and APHIS may deny an application or 
suspend or revoke a registered entity's certificate of registration if the 
individual or entity, responsible official, or owner of the entity is 
reasonably suspected of criminal violations or does not comply with the 
select agent regulations or if denial, suspension, or revocation is necessary 
to protect public, animal, or plant health and safety. A suspension can be 
for all select agent work at a registered entity or be specific to particular 
agents. 

• Civil Money Penalties or Criminal Enforcement: CDC refers possible 
violations of the select agent regulations to the HHS Office of Inspector 
General (OIG). The HHS-OIG can levy civil money penalties (for an 
individual, up to $250,000 for each violation and, for an entity, up to 
$500,000 for each violation) or recommend criminal enforcement 
(imprisonment for up to 5 years, a fine, or both). As of April 29, 2009, 
CDC's DSAT had referred 48 entities to the HHS-OIG for violating select 
agent regulations. HHS-OIG had levied $1,997,000 in civil money penalties 
against 13 of these entities. Information regarding these entities can be 
found on the following Web sites: 

http://oig.hhs.gov/fraud/enforcement/cmp/agents_toxins.asp and 
http://oig.hhs.gov/fraud/enforcement/cmp/agents_toxins_archive.asp. Also, 
the agricultural select agent program relies on APHIS' own investigative 
unit, USDA Marketing and Regulatory Programs — Investigative and 
Enforcement Services (IES), for initial investigations of potential select 
agent violations. Like the HHS-OIG, IES can levy civil money penalties or 
recommend criminal enforcement. IES refers potential criminal violations 
to USDA's OIG. From 2002— when APHIS first became involved with 
select agents — until May 7, 2009, the agricultural select agent program 
referred 39 entities or unregistered persons to IES for potential violations 
of the select agent regulations. USDA has levied $547,500 in civil money 
penalties against nine of these entities or unregistered persons. USDA 
does not publish information on select agent investigations or the results 
of these investigations. 

• Referral to DOJ: DSAT or APHIS can refer possible criminal violations 
involving select agents to DOJ for further investigation or prosecution. 
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Pertinent Guidelines 

The laws and regulations discussed above provide requirements for 
individuals and entities possessing, using, or transferring select agents and 
toxins but do not apply universally to high-containment laboratories. 
However, guidance for operating high-containment laboratories that is not 
legally mandatory is available. Pertinent guidance includes HHS's BMBL 
manual and the NIH Guidelines for Research Involving Recombinant 
DNA Molecules. 

HHS's BMBL Manual: The BMBL, prepared by NIH and CDC, categorizes 
laboratories on four biosafety levels (BSL) based on risk criteria, with 
BSL-4 laboratories being utilized for the study of agents that pose the 
highest threat risk to human health and safety. The BMBL describes a code 
of practice for biosafety and biocontainment in microbiological, 
biomedical, and clinical laboratories. The BMBL serves as the primary 
recognized source of guidance on the safe practices, safety equipment, and 
facility containment needed to work with infectious agents. The first 
publication was in 1984, and the most recent (5th edition) was published 
electronically in 2007. The select agent regulations reference the BMBL as 
a document to consider when entities are developing their written 
biosafety plans. Even though the BMBL is issued as a guidance document, 
DSAT and APHIS have incorporated certain elements of it into their 
inspection checklists as a requirement of the select agent program. 

The BMBL states that (1) biosafety procedures must be incorporated into 
the laboratory's standard operating procedures or biosafety manual, (2) 
personnel must be advised of special hazards and are required to read and 
follow instructions on practices and procedures, and (3) personnel must 
receive training on the potential hazards associated with the work and the 
necessary precautions to prevent exposure. Further, the BMBL (5th 
edition) provides guidance on biosecurity, such as methods of controlling 
access to areas where agents are used or stored. The BMBL also states 
that a plan must be in place for informing police, fire, and other emergency 
responders concerning the type of biological materials in use in the 
laboratory areas. 

NIH Guidelines for Research Involving Recombinant DNA 
Molecules: Some of the work in BSL-3 and BSL-4 laboratories in the 
United States involves rDNA, and the standards and procedures for 
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research involving rDNA are set by the NIH Guidelines for Research 
Involving Recombinant DNA Molecules (NIH rDNA Guidelines). 21 
Institutions must follow these guidelines when they receive NIH funding 
for work with rDNA. The guidelines include the requirement to establish 
an institutional biosafety committee (IBC), which is responsible for (1) 
reviewing rDNA research conducted at or sponsored by the institution for 
compliance with the NIH rDNA Guidelines and (2) reviewing categories 
of research as delineated in the NIH rDNA Guidelines. IBCs also 
periodically review ongoing rDNA research to ensure continued 
compliance with the guidelines. While the guidelines are only mandatory 
for those institutions receiving NIH funding, they have become generally 
accepted standards for safe working practice in this area of research and 
are followed voluntarily by many companies and other institutions not 
otherwise subject to their requirements. 



The Number of BSL-4 
and BSL-3 
Laboratories and 
Their Workforce Are 
Increasing in 
Different Sectors 
throughout the United 
States 



Since 2001, the number of BSL-4 and BSL-3 laboratories in the United 
States has increased, and this expansion has taken place across federal, 
state, academic, and private sectors and throughout the United States. 
Federal officials and experts believe that while the number of BSL-4 
laboratories in the United States is known, the number of BSL-3 
laboratories is unknown. Information about the number, location, 
activities, and ownership is available for high-containment laboratories 
that are registered with the DSAT or APHIS select agent programs but not 
for those outside the program. 

A number of issues are associated with determining the overall number of 
BSL-3 and BSL-4 laboratories. In our discussions with federal agency 
officials and experts and in our review of the literature, we found that the 
total number depended upon how the question was phrased. While data 
were generally available on the number of facilities or sites that contained 
a BSL-3 or BSL-4 laboratory, the precise number of independent rooms 
within those facilities qualifying as BSL-3 or BSL-4 laboratories was not 
generally specified. Some facilities contain more than one actual 
laboratory. For example, while CDC has two facilities with BSL-4 capacity, 
one of the facilities actually contains two separate BSL-4 laboratories, 
while the other has four separate BSL-4 laboratories. These officials and 



In the context of the NIH rDNA Guidelines, recombinant DNA molecules are defined as 
either (1) molecules that are constructed outside living cells by joining natural or synthetic 
DNA segments to DNA molecules that can replicate in a living cell or (2) molecules that 
result from the replication of those described in (1) above. 
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experts also told us that counting the number of laboratories is 
problematic because the definition of the term "laboratory" varies. A more 
meaningful measure is determining the net square footage of working BSL- 
4 space. However, this information is often not available. In addition, there 
also are methodological issues associated with determining whether a 
laboratory is operational or not. 

The expansion of high-containment laboratories in the United States began 
in response to the emergency situation resulting from the anthrax attacks 
in 2001. Understandably, the expansion initially lacked a clear, 
governmentwide coordinated strategy. In that emergency situation, the 
expansion was based on the perceptions of individual agencies about the 
capacity required for their high-containment laboratory activities as well 
as the availability of congressionally approved funding. Decisions to fund 
the construction of high-containment laboratories were made by multiple 
federal agencies in multiple budget cycles. Federal and state agencies, 
academia, and the private sector considered their individual requirements, 
but a robust assessment of national needs was lacking. Since each agency 
has a different mission, an assessment of needs, by definition, is at the 
discretion of the agency. We have not found any national research agenda 
linking all these agencies that would have allowed for such a national 
needs assessment. Even now, after more than 7 years, we have not been 
able to find any detailed projections based on a governmentwide strategic 
evaluation of future capacity requirements in light of existing capacity; the 
numbers, location, and mission of the laboratories needed to effectively 
counter biothreats; and national public health goals. Without this 
information, there is little assurance of having facilities in the right places 
with the right specifications to meet a governmentwide strategy. 



The Number of BSL-4 For most of the past 50 years, there were only two entities 22 with BSL-4 

Laboratories Is Increasing laboratories in the United States: federal laboratories at USAMRIID at Fort 
in Some Sectors Detrick, Maryland, and at the CDC in Atlanta, Georgia. Between 1990 and 

2000, three new BSL-4 laboratories were built: (1) the first BSL-4 university 



An entity is defined in the select agent regulations as any government agency (federal, 
state, or local), academic institution, corporation, company, partnership, society, 
association, firm, sole proprietorship, or other legal body. A private entity is a company 
whose shares are not traded on the open market, as a commercial entity's are. 
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laboratory (a glovebox, rather than a conventional laboratory) 23 at Georgia 
State University in Atlanta; (2) the University of Texas Medical Branch 
(UTMB) Robert E. Shope BSL-4 laboratory in Galveston, Texas; and (3) 
the Southwest Foundation for Biomedical Research, a privately funded 
laboratory in San Antonio, Texas. These entities were registered with CDC 
prior to 2004. In 2004, these entities registered their facilities with DSAT 
under the select agent regulations. 24 As of June 2009, two new BSL-4 
laboratories became operational: CDC Emerging Infectious Diseases 
laboratory in Atlanta, Georgia, and NIAID Rocky Mountain laboratory in 
Hamilton, Montana. To date, there are seven operational BSL-4 
laboratories in the United States. 



Table 3 shows the number of entities with BSL-4 laboratories by calendar 
year and sector. 



Table 3: Entities Registered with DSAT That Maintain BSL-4 Laboratories, by Calendar Year and Sector 








Number of BSL-4 laboratories by sector 






Year 


Total number 
of entities 


Federal 
government 


State/local 
government 


Academic 


Private 
(nonprofit) 


Commercial 
(for profit) 


2004 


5 


2 





2 




1 





2005 


5 


2 





2 




1 





2006 


5 


2 





2 




1 





2007 


5 


2 





2 




1 





2008 


5 


2 





2 




1 





2009 


7 


4 





2 




1 






Source: CDC select agent program as of J une 2009. 

Note: All six entities in the United States with operational BSL-4 laboratories are registered with 
DSAT; none are registered with APHIS. One entity has two BSL-4 laboratories. 



Since the anthrax attacks in 2001, seven new BSL-4 facilities are in the 
planning, construction, or commissioning stage. Four of these facilities are 



A glovebox (or glove box) is a sealed container that is designed to allow one to 
manipulate objects while being in a different atmosphere from the object. Built into the 
sides of the glovebox are two gloves arranged in such a way that the user can place his or 
her hands into the gloves and perform tasks inside the box without breaking the seal or 
allowing potential injury. Part or all of the box is usually transparent to allow the user to 
see what is being manipulated. 

24 Although the select agent regulations were not finalized until 2005, interim final rules 
required registration in 2003. 
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in the federal sector, two are in the academic sector, and one is in the 
state/local government sector. 

The following are the BSL-4 facilities in the planning, construction, or 
commissioning stage in the federal sector: 

(1) NIAID Integrated Research Facility, Fort Detrick, Maryland; 

(2) DHS National Biodefense Analysis and Countermeasure Center, Fort 
Detrick, Maryland; 

(3) DHS National Bio- and Agro-Defense Facility (NBAF), Manhattan, 
Kansas; and 

(4) DOD USAMRIID Recapitalization, Fort Detrick, Maryland. This new 
BSL-4 laboratory will replace the existing USAMRIID laboratory. 

The following BSL-4 facilities are in the planning or construction stage in 
the academic sector and are funded by NIAID: 

(5) National Biocontainment Laboratory (NBL) at Boston University, 
Boston, Massachusetts, and 

(6) NBL at the University of Texas Medical Branch, Galveston, Texas. 

One BSL-4 facility is being built in the state/local government sector to 
identify and characterize highly infectious emerging diseases that pose a 
threat to public health: 

(7) Virginia Division of Consolidated Laboratory Services, Richmond, 
Virginia. 25 

The total number of BSL-4 laboratorieswill increase from 7 to 13 when 
these laboratories become operational. 26 The locations of the BSL-4 



° According to CDC, while this laboratory is being built as a BSL-4 laboratory, it will 
operate as a BSL-3 laboratory. 

26 The 7 BSL-4 laboratories that are operational as of 2009 and the 7 new facilities that are 
not yet operational total 14. However, the new USAMRIID Recapitalization Laboratory will 
replace an existing facility at Ft. Detrick, making the total 13. Figure 1, however, includes 
both the new and existing USAMRIID facilities since it shows both operational and 
nonoperational laboratories as of June 2009. 
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laboratories that are currently registered, under construction, or in the 
planning stage are shown in figure 1. 



Figure 1 : Entities Registered with DSAT That Maintain BSL-4 Laboratories, by Calendar Year and Sector 
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Georgia State University 
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Source: GAO design based on NIAID information. Art Explosion (map), open sources. 

Note: The figure show 14 laboratories ratherthan 13 because the USAMRIID Recapitalization 
Laboratory at Ft. Detrick is shown along with the currently operational laboratory that it will eventually 
replace. 



CDC officials told us that the enormous cost of construction would 
preclude operators from building a BSL-4 laboratory unless they were 
going to work with one or more of the select agents that require BSL-4 
level containment. Based on this reasoning, these officials believe that 
they know all existing operational BSL-4 laboratories in the United States 
because these laboratories are required to be registered under the select 
agent regulations. However, registration with DSAT is a requirement based 
on possession of select agents and not ownership of a BSL-4 laboratory. 
Therefore, if a BSL-4 laboratory, like the laboratory in Richmond, Virginia, 
is commissioned using simulants, and all diagnostic work is done 
effectively by using biochemical reagents, gene probes, and possibly 
inactivated agents as controls, there would be no legal requirement for 
registration. Thus, CDC may not know of all BSL-4 laboratories. 
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BSL-3 Laboratories Are CDC officials stated that unlike the case with BSL-4 laboratories, 

Being Built in All Sectors operators might build BSL-3 laboratories and not work with select agents, 
throughout the United ^ or exam Pl e > when building new laboratories or upgrading existing ones, 

States many laboratory owners may build to meet BSL-3 level containment, often 

in anticipation of future work, even though they intend for some time to 
operate at the BSL-2 level with BSL-2 recommended agents. Consequently, 
CDC officials acknowledged that they do not know the total number of 
BSL-3 laboratories in the United States that are not registered to possess, 
use, or transfer select agents. 

In April 2007, we conducted a Web-based survey — based on a search of 
publicly available sources — of contacts knowledgeable about high- 
containment laboratories (for example, biosafety officers). 27 A number of 
respondents who stated that their institutions had high-containment 
laboratories said that their laboratories were not working with select 
agents and were therefore not registered with the DSAT or APHIS select 
agent program. Although the respondents were not randomly selected, the 
results suggest that there may be many BSL-3 laboratories that do not 
work with select agents. These laboratories could potentially be tapped for 
use if national strategy required additional capacity. 

In 2004, there were far more entities registered with CDC that maintained 
BSL-3 laboratories than BSL-4 laboratories (150 versus 5), and this number 
grew to 242 in 2008. As shown in figure 2, these entities accounted for a 
total of 415 registered BSL-3 laboratories in 2004; this number grew to 
1,362 by 2008 (a more than three-fold increase). 28 



27 The response rate for the survey was 41 percent. See appendix I for additional details. 
28 Entities may define a laboratory as one room or a series of rooms. 
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Figure 2: BSL-3 Laboratories Maintained by Entities Registered with DSAT, by 
Calendar Year and Sector 
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Source: GAO analysis based on NIAID information. 

Between 2004 and 2008, the largest increase occurred in the academic 
sector (from 120 to 474, an increase of 354 laboratories) followed by the 
federal government (from 130 to 395, an increase of 265 laboratories). 
Table 4 details these increases. 



Table 4: BSL-3 Laboratories Maintained by Entities Registered with DSAT, by Calendar Year and Sector 



Sector 



Year 


Number of 
entities 


Number of 
laboratories 


Federal 
government 


State/local 
government 


Academic 


Private 
(nonprofit) 


Commercial 
(for profit) 


2004 


150 


415 


130 


118 


120 


28 


19 


2005 


210 


782 


192 


171 


299 


76 


44 


2006 


237 


1,086 


271 


220 


438 


95 


62 


2007 


238 


1,176 


347 


254 


388 


119 


68 


2008 


242 


1,362 


395 


295 


474 


125 


73 



Source: DSAT program as of February 2009. 

Note: Laboratories may be defined by the entity as one room or a series of rooms (e.g., a suite). 
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APHIS experienced only a slight increase in the entities with BSL-3 
laboratories that registered between 2004 and 2007 (from 41 to 45); 
however, in 2008, APHIS transferred 8 BSL-3 facilities to DSAT as the 
result of a change in the select agent list rules. Overall, the number of 
entities registered with APHIS was much lower than DSAT's total. (See 
table 5.) 



Table 5: BSL-3 Laboratories Maintained by Entities Registered with APHIS, by Calendar Year and Sector 



Sector 



Year 


Number of 
entities 


Number of 
laboratories 


Federal 
government 


State/local 
government 


Academic 


Private 
(nonprofit) 


Commercial 
(for profit) 


2004 


41 


290 


179 


10 


42 


20 


39 


2005 


42 


293 


179 


10 


48 


20 


36 


2006 


44 


299 


179 


15 


49 


20 


36 


2007 


45 


303 


179 


15 


48 


20 


41 


2008 


37 a 


281 


179 


8 


45 


20 


26 



Source: APHIS, J une 2009. 

Note: The number of laboratories includes BSL-3 and ABSL-3 laboratories. 

"Eight APHIS BSL-3 entities were transferred to CDC as a result of the select agent list rule change in 
2008. 



As shown in table 6, the size of the state public health laboratories 
network increased following the 2001 anthrax attacks. According to a 
survey conducted by the Association of Public Health laboratories (APHL) 
in August 2004, state public health laboratories have used public health 
preparedness funding since 2001 to build, expand, and enhance BSL-3 
laboratories. 29 In 1998, APHL found that 12 of 38 responding states 
reported having a state public health laboratory at the BSL-3 level. As of 
March 2009, all 50 states had at least one state public health BSL-3 
laboratory. 30 



Association of Public Health Laboratories, Public Health Laboratory Issues in Brief: 
Bioterrorism Capacity (Washington D.C., April 2005). 

30 Personal communication from APHL, March 2009. 
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Table 6: BSL-3 Laboratories in the State Public Health System 



Calendar year 


State public health BSL-3 laboratories 


2001 


69 


2002 


71 


2003 


139 



Source: Association of Pubiic Health laboratories, 2005. 



Since the anthrax attacks of 2001, BSL-3 laboratories have started to 
expand geographically as well as by sector. As mentioned above, because 
individual states need to respond to bioterrorist threats, all 50 states now 
have some BSL-3 level capacity — at least for diagnostic and analytical 
services — to support emergency response. 31 

Additionally, NIAID recently funded the construction of 13 BSL-3 Regional 
Biocontainment Laboratories (RBL) within the academic research 
community at the following universities: 

(1) Colorado State University, Fort Collins, Colorado; 

(2) Duke University Medical Center, Durham, North Carolina; 

(3) George Mason University, Fairfax, Virginia; 

(4) University of Hawaii, Manoa, Hawaii; 

(5) University of Louisville, Louisville, Kentucky; 

(6) University of Medicine and Dentistry of New Jersey; Newark, 
New Jersey; 

(7) Tufts University, Grafton, Massachusetts; 

(8) Tulane National Primate Research Center, Covington, Louisiana; 

(9) University of Alabama, Birmingham, Alabama; 

(10) University of Chicago, Argonne, Illinois; 

(11) University of Missouri, Columbia, Missouri; 

(12) University of Pittsburgh, Pittsburgh, Pennsylvania; and 

(13) University of Tennessee Health Science Center, Memphis, 
Tennessee. 



We reported on the importance of building adequate laboratory capacity to respond to 
both natural and terrorist-related outbreaks. See West Nile Virus Outbreak: Lessons for 
Public Health Preparedness (GAO/HEHS-00-180, Sept. 11, 2000) and Infectious Disease 
Outbreaks: Bioterrorism Preparedness Efforts Have Improved Public Health Response 
Capacity, But Gaps Remain (GAO-03-654T, Apr. 9, 2003). 
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NIAID is constructing RBLs to provide regional BSL-3 laboratory capacity 
to support NIAID's Regional Centers of Excellence for Biodefense and 
Emerging Infectious Diseases Research. The RBLs are distributed 
regionally around the country. 

Figure 3 shows the sites of NIAID-funded RBLs in the United States. 



Figure 3: BSL-3 Laboratories Maintained by Entities Registered with APHIS, by Calendar Year and Sector 



Colorado State University 

Fort Collins, CO 



University of Hawaii at Manoa 

Honolulu, HI 



> Operational 
(YpNotOperational 



University of Missouri, Columbia 
College of Veterinary Medicine 

Columbia, MO 



University of Chicago 

Argonne, IL 




Tufts University School of 
Veterinary Medicine 

Grafton, MA 



University of Medicine and 
Dentistry of New Jersey 

Newark, NJ 



University of Pittsburgh 

Pittsburgh, PA 



George Mason University 

Fairfax, VA 



Duke University Medical Center 

Durham, NC 



Tulane National Primate Research Center 

Covington, LA 



University of Tennessee 

Memphis, Tennessee 



University of Louisville 

Louisville, KY 



University of Alabama-Birmingham 
School of Medicine 

Birmingham, AL 



Source: GAO design based on NIAID information. Art Explosion (map). 



The Workforce in BSL-3 As expected, with an increase in the number of entities and laboratories 

and BSL-4 Laboratories Is t na * WOI "k with select agents, the number of individuals DSAT approved 
Increasing ^ or access t° WOI "k m the laboratories increased between 2004 and 2008. 

Table 7 shows the total number of individuals with active access approvals 

from DSAT and APHIS. 
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Table 7: Individuals with Active Access Approvals from DSAT and APHIS, by End of Calendar Year and Sector 











Sector 






Year 


Number of 
individuals 9 


Federal 
government 


State/local 
government 


Academic 


Private 
(nonprofit) 


Commercial 
(for-profit) 


2004 


8,335 


2,629 


1,986 


2,309 


784 


627 


2005 


9,603 


2,776 


2,280 


2,760 


982 


805 


2006 


10,134 


2,912 


2,420 


3,006 


975 


821 


2007 


10,473 


3,067 


2,517 


3,090 


1,004 


795 


2008 


10,365 


3,006 


2,384 


3,110 


1,036 


829 



Source: DSAT, as of February 2009. 



Note: Data from DSAT and APHIS are available only from 2004 to the present as entities were not 
required to be fully registered until November 12, 2003. 

"Totals include laboratory staff and laboratory support staff (e.g., maintenance, security, and IT 
support) with access approvals from DSAT for BS L-2, BSL-3, and BSL-4 laboratories and not the 
total number of staff that work with select agents. 

In 2004, 8,335 individuals had access approvals. This number increased to 
10,365 by 2008. 32 The largest growth was in the academic sector. In 2004, 
2,309 individuals in the academic sector had access approvals; this number 
increased to 3,110 by 2008 (an increase of 801 workers). In addition to 
those workers approved by DSAT, 4, 149 individuals had access approvals 
through APHIS as of February 2009. It is important to note that as the 
number of new entities and high-containment laboratories increases, many 
new workers are being hired to work in these laboratories. However, not 
much is currently known about the characteristics of this workforce 
because there are no requirements in the select agent regulations to report 
on qualifications. In addition, there are no national standards for training 
of workers or standardized certification programs to test the proficiency 
of these workers. 



DSAT officials told us that their current database includes data on (1) the number of 
workers approved to have access to select agents and toxins by CDC or APHIS following a 
security risk assessment by the FBI and (2) workers who work with select agents in BSL-2 
laboratories. However, DSAT officials are now working on a system that will be able to 
show the number of workers by type of laboratory (for example, BSL-2, BSL-3, and BSL-4) 
and type of worker (for example, laboratory staff and support staff). In accordance with 42 
C.F.R. 73.10, security risk assessments are conducted on all individuals who wish to gain 
access to select agents. Following the completion of that assessment, an individual is 
granted access approval to select agents provided that the individual is not identified as a 
restricted person as defined in section 175b of title 18 of the United States Code. 
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The increase in the number of entities and high-containment laboratories 
that work with select agents has implications for federal oversight. As part 
of regulatory requirements, DSAT and APHIS staff inspect each entity 
prior to issuing a certificate of registration to ensure that the entity is in 
compliance with the select agent regulations. In addition, as part of the 
entity's renewal process, which occurs every 3 years, DSAT and APHIS 
inspectors are required to reinspect the entity. APHIS performs additional 
annual compliance inspections between the 3-year renewal cycles even if 
there is no change. DSAT performs additional inspections when an entity 
adds a select agent or toxin, a new laboratory facility, or a new procedure 
that requires verification of the entity's biosafety plans and procedures. 

As mentioned previously, the number of entities and the number of BSL-3 
laboratories working with select agents increased between 2004 and 2008. 
As a result of this increase, DSAT now has to inspect more entities. 

As shown in table 8, DSAT had a budget of $14 million and had 25 full-time 
equivalent inspectors (5 federal and 20 contract) in fiscal year 2004, when 
the interim regulations first provided for certificates of registration. 
However, its budget decreased between 2004 and 2008. In 2004, DSAT was 
responsible for providing oversight to 150 entities with 415 BSL-3 
laboratories. In 2008, DSAT provided oversight to 242 entities with 1,362 
BSL-3 laboratories with a decreased budget and only 3 more inspectors (11 
federal and 17 contract). No evaluations are available to determine how 
this increased mission and decreased budget affected the quality of 
oversight. 



Table 8: DSAT Budget and Staff for Select Agent Oversight Program by Fiscal Year 




Total DSAT staff 




DSAT inspectors 


Fiscal DSAT budget (current 
year dollars in millions) 9 


Federal staff" 


Contract staff 


Federal inspectors Contract inspectors 


2004 $14.2 


18 




58 


5 20 


2005 $13.5 


17 




63 


6 23 


2006 $13.0 


16 




64 


9 22 


2007 $14.3 


18 




60 


10 17 


2008 $12.1 


22 




64 


11 17 



Source: DSAT, April 2009. 
Notes: 

(1) DSAT budget and staffing figures include both the select agent program and the etiological agent 
import permit program. 

(2) As of April, 2009, the estimated fiscal year 2009 budget for DSAT was $13.6 million. There 
currently are 23 federal staff (10 inspectors) and 64 contract staff (20 inspectors) assigned to DSAT. 



Budget and Resources for 
Select Agent Oversight 
Program 
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This represents the total DSAT budget (ceilings). 

b These figures reflect the actual number of federal employees working in DSAT at the end of the fiscal 
year and do not include vacant positions. However, they do include the number of federal inspectors. 

These figures include the number of contract staff (e.g., inspectors, data entry personnel, and record 
managers) assigned to DSAT at the end of the fiscal year. 

Before 2005, when APHIS had no select agent line item, it funded select 
agent program activities using a variety of existing funding sources (e.g., 
homeland security). As shown in table 9, APHIS received a budget of $2.5 
million in fiscal year 2005. APHIS officials estimate that the service has 
devoted about 5 staff years to select agent inspections for each year since 
2006. No evaluations are available to determine whether APHIS has 
sufficient resources to carry out its mission. 



Table 9: APHIS'S Budget and Staff for Select Agent Oversight Program 


APHIS Staff 


APHIS budget (current 
Fiscal year dollars in millions 9 ) Federal staff" 


Contract staff 


Federal inspectors 
(staff years) 


Contract 
inspectors 


2004 





3 





2005 $2.5 6 





4 





2006 $3.5 18 





5 





2007 $3.5 18 





5 





2008 $4.2 18 





5 





2009 $5.2 22 





5 






Source: APHIS, May 2009. 



These budget numbers represent dollars allocated to APHIS forthe Agricultural Select Agent 
Program. 

The number of federal staff represents not only staff members who devote 100 percent of their time 
to the regulatory program but also part-time commitments of support personnel, including select 
agent entity inspectors (see footnote c). 

The number of federal inspectors represents the staff years AP HIS devotes to select agent 
inspections. APHIS inspections of select agent laboratories are performed by AP HIS 
veterinarians/inspectors stationed throughout the United States and two select agent staff members 
stationed in Riverdale, Maryland. These inspectors also perform other similar duties— for example, 
inspections of entities and containment facilities in support of APHIS'S permitting system pursuantto 
the Animal Health Protection Act and the Plant Protection Act. For this reason, the number of staff 
years APHIS devotes to select agent inspections is less than the number of trained inspectors. 
APHIS estimates that it has devoted about 5 staff years annually to select agent inspections since 
2006. 
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No Federal Agency 
Has the Mission to 
Track the Expansion 
of All High- 
Containment 
Laboratories and 
Regulate Biosafety in 
the United States 



Currently, no executive or legislative mandate directs any federal agency 
to track the expansion of all high-containment laboratories. Because no 
federal agency has the mission to track the expansion of BSL-3 and BSL-4 
laboratories in the United States, no federal agency knows how many such 
laboratories exist in the United States. While there is a consensus among 
federal agency officials and experts that some degree of risk is always 
associated with high-containment laboratories, no one agency is 
responsible for determining, or able to determine, the aggregate or 
cumulative risks associated with the expansion of these high-containment 
laboratories. 33 

As shown in table 10, none of the 12 federal agencies that responded to 
our survey indicated that they have the mission to track and know the 
number of all BSL-3 and BSL-4 laboratories within the United States. 



Table 10: Federal Agencies without a Mission to Track and Know the Number of All 
BSL-3 and BSL-4 Laboratories within the United States 


Agency 


Mission to track 


Know the number 


Department of Commerce 


No 


No 


Department of Defense 


No 


No 


Department of Energy 


No 


No 


Department of Health and Human Services 


No 


No 


Department of Homeland Security 


No 


No 


Department of Interior 


No 


No 


Department of J ustice 


No 


No 


Department of Labor 


No 


No 


Department of State 


No 


No 


Department of Veterans Affairs 


No 


No 


Environmental Protection Agency 


No 


No 


U.S. Department of Agriculture 


No 


No 



Source: G AO Survey of Federal Agencies Involved with BSL-3 and BSL-4 laboratories, 2007. 



While some federal agencies do have a mission to track a subset of BSL-3 
and -4 laboratories that work with select agents and know the number of 
those laboratories, no single regulatory agency has specific responsibility 
for biosafety in all high-containment laboratories in the United States. 



Aggregate risks are defined as the sum total of all the risk elements associated with 
operating a high-containment laboratory. 
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According to some experts and federal agency officials, the oversight of 
these laboratories is fragmented and relies on self-policing. For example, if 
an entity is registered under the select agent regulations, DSAT or APHIS 
provides oversight. On the other hand, if an entity receives federal funding 
from NIH for rDNA research, the NIH Office of Biotechnology Activities 
provides oversight. These agencies assume that all risks would be dealt 
with by the entities' self-regulation, consistent with the laboratory practice 
guidelines developed by NIH and CDC. 34 



Risks Associated with the 
Expansion of High- 
Containment Laboratories 



Several federal agencies told us that they should know the number and 
location of all BSL-3 and -4 laboratories to carry out their agency missions. 
Some intelligence agencies, for example, indicated that — if there is 
another incident similar to the 2001 anthrax attacks — they would need to 
know the number and location of high-containment laboratories that do 
not work with select agents within the United States to identify all 
potential sources that could have been used to prepare the material. These 
officials told us that a determined scientist could easily take a small 
quantity of a select agent from his or her laboratory to a non-select-agent 
laboratory to grow the material. 

According to these intelligence agencies, these high-containment 
laboratories represent a capability that can be targeted by terrorists or 
misused by insiders with malicious intent. 35 While some agencies have the 
specific responsibility for determining threats from rogue nations and 
foreign and domestic terrorists, we found that no agency has the mission 
to proactively determine the threat from insiders. 

According to most experts, there is a baseline risk associated with any 
high-containment laboratory. With expansion, the aggregate risks increase. 
However, no agency has the mission to determine whether the risks 



34 HHS has established a Trans-Federal Task Force on Optimizing Biosafety and 
Biocontainment Oversight to undertake an intensive analysis of the current framework of 
biosafety and biocontainment oversight of research activities involving infectious agents 
and toxins in high- and maximum-containment research facilities with the goal of exploring 
strategies to address concerns voiced by Congress and the general public. The task force is 
chaired by officials from HHS and UDSA and comprises representatives from a broad range 
of federal departments and agencies that have responsibility for and oversight of the 
management of biohazard risks. 

35 Some intelligence agencies have a mission to track and a need to know the number of all 
BSL-3 and BSL-4 laboratories or their equivalents abroad. However, they do not know the 
total number of those laboratories. 
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associated with expansion increase in proportion to the number of 
laboratories or at some different rate or whether factors such as location 
and resource limitations may affect the risk ratio. Because CDC and USDA 
regulations require that entities registering with the select agent program 
assess only the risks associated with their individual laboratories, CDC 
and USDA do not have the mission to determine the aggregate risks 
associated with the expansion of high-containment laboratories that work 
with select agents. 

High-containment laboratories can pose health risks for individual 
laboratory workers as well as the surrounding community. However, the 
relative risk profile of new versus more established laboratories is not 
known. According to CDC officials, the risks from accidental exposure or 
release can never be completely eliminated, and even laboratories within 
sophisticated biological research programs — including those most 
extensively regulated — have had and will continue to have safety failures. 

In addition, while some of the most dangerous agents are regulated under 
the CDC-APHIS select agent program, high-containment laboratories also 
work with agents not covered under this program. Laboratories outside 
the select agent program, especially those working with emerging 
infectious diseases, can also pose biosafety risks from accidental exposure 
or release. Several of these biological agents are listed in the BMBL as 
requiring BSL-3 practices, including West Nile Virus and Hantavirus. (See 
appendix IV for a list of biological agents recommended to be handled in 
BSL-3 laboratories that are not select agents). 

Consequently, laboratories having capabilities to work with biological 
agents, even though they do not posses select agents, are not currently 
subject to oversight. These laboratories also have associated biosecurity 
risks because of their potential as targets for terrorism or theft by either 
internal or external perpetrators, laboratories outside the select agent 
program also represent a capability that can be paired with dangerous 
pathogens and skilled but ill-intentioned scientists to become a threat. 



Currently, no laws in the United States specifically focus on all high- 
containment laboratories. In the United Kingdom (U.K.), by contrast, new 
high-containment laboratories that work with human, animal, or 
genetically modified (GM) pathogens need to notify the U.K. regulator (the 
Health and Safety Executive (HSE)) and receive either consent (for GM 
human pathogens) or license (for animal pathogens) before they 
commence their activities. 



Unlike the United 
Kingdom, the United 
States Has No Laws to 
Assist in Tracking High- 
Containment Laboratories 
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Prior to construction of the facility, there is no requirement to inform HSE 
(except for planning authorities, who look at land use and building 
quality); however, in practice, HSE staff are involved at the design stage 
and at various points during the construction process. According to HSE 
staff, this early involvement has been extremely helpful in ensuring that 
new facilities meet the standards set out in the legislation and supporting 
guidance (related to the management, design, and operation of high- 
containment laboratories). 

This involvement has also enabled HSE to address the application of new 
technologies in high-containment laboratories (e.g., alkaline hydrolysis for 
waste destruction as an alternative to incineration). While the legislation 
in the U.K. states that a BSL-4 laboratory must have an incinerator on site 
for disposal of animal carcasses, HSE staff told us that they have been 
involved in discussions relating to new facilities where the entities wanted 
to replace the incinerator with an alkaline hydrolysis system. Similarly, all 
BSL-4 laboratories use cabinet lines (for human pathogens). HSE staff 
have been in discussion with entities about proposals to move to a suited 
system rather than rely entirely on primary containment. HSE staff told us 
that they are recognizing that technologies change and there may be good 
reasons to move away from established procedures, assuming that the 
alternatives being proposed provide a high degree of assurance that 
biosafety and biosecurity will not be compromised by the changes. 

In April 2010, the U.K. plans to implement a single regulatory framework 
for human, animal, and genetically modified pathogens that will include a 
legal requirement for duty holders to consult the regulatory authority prior 
to construction and for HSE to be a statutory consultee as part of the 
planning authorization. 36 



36 The current legislation that authorizes work with these high hazard pathogens is Control 
of Substances Hazardous to Health (COSHH) Regulations 2002, Genetically Modified 
Organisms (Contained Use) Regulations 2000 (as amended 2005), and Specified Animal 
Pathogens Order 2008. 
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Lessons Learned from 
Four Incidents 
Highlight the Risks 
Inherent in the 
Expansion of High- 
Containment 
Laboratories 



We reviewed four incidents that highlight the risks inherent in the 
expansion of high-containment laboratories: alleged insider misuse of a 
select agent and laboratory; Texas A&M University's (TAMU) failure to 
report to CDC exposures to select agents in 2006; power outages at CDC's 
high-containment laboratories in 2007 and 2008; and the release of foot- 
and-mouth disease virus in 2007 at the Pirbright facility in the U.K. 

We reviewed these incidents in detail because they represented different 
types of risk associated with high-containment laboratories and because a 
significant amount of information was available concerning them. 
According to the experts we talked with, many other incidents and 
accidents have occurred, mainly as a result of human error or equipment 
failure. Fortunately, most incidents/accidents do not have serious 
consequences for the health of laboratory workers, the general population, 
or the environment. The experts we spoke with also stated that it is highly 
probable that many incidents go unreported and unrecorded because of 
the lack of such serious consequences. Such underreporting represents 
lost opportunities to analyze and learn lessons that can provide a basis for 
continuing improvement and maintenance of laboratory safety. 

We are not making any generalizations about the magnitude of the 
problem involving other laboratories. However, the lessons we have 
identified highlight ways to improve biosafety and biosecurity. These 
lessons also have implications for institutional and federal oversight. 



Incident 1: Alleged Insider 
Misuse of a Select Agent 
and Laboratory 



In September and October 2001, letters containing spores of B. anthracis 
powder were distributed through the U.S. postal system to two senators, 
Thomas Daschle and Patrick Leahy, and members of the media. 37 The 



The anthrax attacks came in two waves. The first set of anthrax letters had a Trenton, 
New Jersey, postmark dated September 18, 2001, exactly 1 week after the September 11, 
2001, attacks. Three letters are believed to have been mailed at this time to NBC News and 
the New York Post, both located in New York City, and to the National Enquirer at 
American Media, Inc., in Boca Raton, Florida. Two more anthrax letters, bearing the same 
Trenton postmark, were dated October 9, 3 weeks after the first mailing. The letters were 
addressed to two Democratic Senators, Thomas Daschle of South Dakota and Patrick 
Leahy of Vermont. 
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letters led to the first U.S. cases of anthrax disease related to bioterrorism, 
and the subsequent investigation by FBI has been called "Amerithrax." 38 

On August 6, 2008, the FBI alleged that the "sole culprit" in the 2001 
anthrax attacks was Dr. Bruce Mns, a U.S. Army scientist with a Ph.D. in 
microbiology who had worked for 28 years at the U.S. Army Medical 
Research Institute for Infectious Diseases (USAMRIID) at Ft. Detrick, 
Maryland. 39 USAMRIID is the only DOD laboratory with the capability to 
study highly dangerous pathogens requiring maximum containment at 
BSL-4. Dr. Mns had helped develop an anthrax vaccine for U.S. troops and 
was in charge of producing large quantities of wet anthrax spores for 
research. 

Immediately following the anthrax mailings in 2001, FBI took 
contaminated evidence to USAMRIID for analysis. Dr. Mns was tasked by 
USAMRIID management to analyze the samples of spores sent through the 
mail and was also a technical consultant to the FBI in the early months of 
investigation. In March 2003, Dr. Mns and two of his colleagues at 
USAMRIID received the Decoration for Exceptional Civilian Service — the 
highest award given to DOD civilian employees — for helping solve 
technical problems in the manufacturing of licensed anthrax vaccine. 

In December 2001, one of Dr. Mns' coworkers told Dr. Mns that she 
observed on several occasions unsafe handling procedures by Diagnostic 
System Division personnel. She also told him that she might have been 
exposed to anthrax spores when handling an anthrax-contaminated letter. 
Dr. Mns began sampling areas in the laboratory space that might have 
been contaminated with anthrax. He took samples from the shared office 
areas and later decontaminated her desk, computer, keypad, and monitor. 
However, he neither documented this incident in the Army record log 



38 The postal facilities in New Jersey and Washington, D.C., that processed the senators' 
letters became heavily contaminated. Other mail routed through these and other postal 
facilities also became contaminated. Numerous federal facilities in the Washington, D.C., 
area — the U.S. Supreme Court and main State Department buildings — were also found to 
be contaminated. The mail for these federal facilities was believed to have either come in 
direct contact with the contaminated letters or passed through sorting equipment at the 
postal facility that processed the letters. In all, 22 individuals contracted anthrax disease in 
four states (Connecticut, Florida, New Jersey, and New York) and Washington, D.C. Five of 
the 22 individuals died. 

39 USAMRIID is an Army installation with BSL-3 and BSL-4 laboratories. These laboratories 
work with select agents and toxins. USAMRIID is regulated by DOD because it is a military 
laboratory and by CDC because it works with select agents and toxins. 



Page 37 



GAO-09-574 High-Containment Laboratories 



book nor notified his superiors. He later acknowledged to Army officials 
that this was a violation of protocol. Dr. Mns' behavior was detailed in an 
Army investigation 40 conducted in response to a second round of sampling 
he conducted in April, but his name did not surface at that time as a 
suspect in the anthrax attacks. 

After a spill incident inside of suite B-3 in building 1425 in April 2002, Dr. 
Mns conducted a second round of unauthorized sampling of his shared 
office space and cold side areas outside of suite B-3. These findings were 
reported and sparked a buildingwide sampling inspection. An inspection 
conducted by the Army 7 months after the anthrax mailing found that suite 
B-3 in building 1425 at USAMRIID was contaminated with anthrax in four 
rooms of suite B-3 (306, 304, cold room, and 313 (Dr. Mns's laboratory)) 
and that the bacteria had escaped from secure to unprotected areas in the 
building. All the areas outside of suite B-3 that tested positive were 
associated with Dr. Mns and members of the Bacteriology Division. The 
inspection report stated that "safety procedures at the facility and in 
individual laboratories were lax and inadequately documented; that safety 
supervision sometimes was carried out by junior personnel with 
inadequate training; and that exposures of dangerous bacteria at the 
laboratory, including anthrax, had not been adequately reported." (See 
appendix V for additional information on the U.S. Army's requirements for 
high-containment laboratories at the time of the 2001 anthrax incidents.) 

In 2005, the FBI investigation began to shift to a particular laboratory at 
USAMRIID, and it began to focus on Dr. Mns as a suspect in 2007. 
According to the FBI, Dr. Mns had the necessary expertise and equipment 
to make the anthrax powder in his laboratory. Specifically, at the time of 
the anthrax mailings, Dr. Mns possessed extensive knowledge of various 
anthrax production protocols. He was adept at manipulating anthrax 
production and purification variables to maximize sporulation and 
improve the quality of anthrax spore preparations. He also understood 
anthrax aerosolization dosage rates and the importance of purity, 
consistency, and spore particle size due to his responsibility for providing 
liquid anthrax spore preparations for animal aerosol challenges. He also 
had used lyophilizers, biological safety cabinets, incubators, and 
centrifuges in vaccine research. Such devices are considered essential for 



Department of the Army, "AR 15-6 Investigation Into Anthrax Contamination at 
USAMRIID," May 16, 2002. 
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the production of the highly purified, powdered anthrax spores used in the 
fall 2001 mailings. 

According to the FBI's application for a search warrant, at the time of the 
attack, Dr. Mns "(1) was the custodian of a large flask of highly purified 
anthrax spores that possess certain genetic mutations identical to the 
anthrax used in the attacks; (2) Mns has been unable to give investigators 
an adequate explanation for his late night laboratory work hours around 
the time of both anthrax mailings; (3) Mns has claimed that he was 
suffering serious mental health issues in the months preceding the attacks, 
and told a coworker that he had 'incredible paranoid, delusional thoughts 
at times' and feared that he might not be able to control his behavior; (4) 
Mns is believed to have submitted false samples of anthrax from his 
laboratory to the FBI for forensic analysis in order to mislead 
investigators; (5) at the time of the attacks, Mns was under pressure at 
work to assist a private company that had lost its FDA approval to 
produce an anthrax vaccine the Army needed for U.S. troops, and which 
Mns believed was essential for the anthrax program at USAMRIID; and (6) 
Mns sent an e-mail to a friend a few days before the anthrax attacks 
warning her that 'Bin Laden terrorists for sure have anthrax and sarin gas' 
and have 'just decreed death to all Jews and all Americans,' language 
similar to the anthrax letters warning 'WE HAVE THIS ANTHRAX ... 
DEATH TO AMERICA ... DEATH TO ISRAEL.'" 41 The FBI stated that in late 
2005, forensic science (genetic analysis) used to trace the anthrax used in 
the 2001 attack had genetic markers consistent with the anthrax spores 
kept in a flask in the refrigerator in Dr. Mns's laboratory at Ft. Detrick, 
Maryland, to spores in the letters. 

During this time, Dr. Mns kept his security clearance and passed a 
polygraph-assisted interrogation (also known as a "lie detector test") in 
which he was questioned about his possible participation in the anthrax 
attacks. In November 2007, he was denied access to all high-containment 
laboratories and, in March 2008, to all laboratories at USAMRIID. It should 
be noted that while Dr. Mns was denied access to the high-containment 
suites in November 2007, he was certified at that time into the personnel 
reliability program. On July 10, 2008, Dr. Mns attended a briefing on a new 
pneumonic plague vaccine under development at the Army's laboratory. 
After this briefing, he was escorted to a psychiatric evaluation off the 



Application and Affidavit for Search Warrant Case Number 08-432, available at 
www.fbi.gov/page2/amerithrax-affidavits/07-524-M-01.pdf. (accessed on June 29, 2009) 
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installation by local authorities, and his access rights to the entirety of 
USAMRIID were withdrawn by the laboratory commander. An order was 
subsequently issued to installation security to prevent Dr. Mns from 
entering the installation unescorted. A written bar order was signed with a 
plan to serve the document to Dr. Mns. Before service of the order 
occurred, he died of a drug overdose on July 29, 2008. 

Lessons Learned: Insider Risk This incident highlights two lessons: (1) an ill-intentioned insider can pose 
and Inventory Control of a risk n °t only by passing on confidential information but also by 

Biological Agents removing dangerous material from a high-containment laboratory, and (2) 

it is impossible to have completely effective inventory control of biological 
material with currently available technologies. It is impossible to know the 
exact number of bacteria or virus in a laboratory's inventory or working 
stocks at any specific time. At Ft. Detrick, ineffective procedures for the 
control of inventories and the unlimited use of laboratory facilities 
allegedly allowed Dr. Mns the opportunity to pursue his own ends. As the 
number of high-containment laboratories increases, there will be an 
increase in the pool of scientists with expertise and, thus, the 
corresponding risk from insiders may also increase. 

Insiders Can Misuse Material and Facilities 

There are arguably two aspects to insider risk: the motive of the insider 
and the ability to misuse material and laboratory facilities. These two 
elements need to be understood if effective countermeasures are to be 
instituted in a proportionate manner. In this case, assuming Dr. Mns was 
the culprit, no one can conclusively determine what motivated his actions 
since he committed suicide before his motive could be determined. 

With regard to the ability to misuse the facility, FBI records show that Dr. 
Mns had unlimited access to material and laboratory facilities. However, it 
is still unclear whether the spores in the letters came directly from the 
flask under Dr. Mns's control or involved some further illicit culturing. In 
either case, material was illegally removed and laboratory facilities were 
misused — at a minimum, to dry and process the spores. It follows that 
research laboratories clearly represent a significant capability that can be 
potentially misused, and this capability is growing with the increasing 
number of high-containment laboratories. While efforts to strengthen 
inventory controls, assess and monitor personnel, and prevent facility 
misuse (for example, by video monitoring) have been undertaken to 
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address insider threats, we are not aware of any evaluation of the 
effectiveness of these measures. 42 While there are clearly major difficulties 
in imposing such controls in research laboratories, insider risk needs to be 
recognized and evaluated. 43 

Assuming that Dr. Mns was the perpetrator in the anthrax attacks, he 
represents one rogue insider in a period of some 60 years, during which 
several thousand scientists and technicians had the opportunity to commit 
similar crimes. Thus, the probability of repeating that one event is, 
historically, very small. Devising any program to reliably reduce that figure 
for biological laboratory personnel is challenging. Furthermore, some 
DOD biological laboratory scientists and academicians we spoke with 
have pointed out that highly intrusive personnel reliability programs, 
which rely on profiling to identify insider threats, can have a negative 
effect on staff morale and performance by institutionalizing the concept 
that no one can be trusted. 44 

The National Science Advisory Board for Biosecurity reported that there is 
little evidence that personnel reliability measures are effective or have 
predictive value in identifying individuals who may pose an insider 
threat. 45 In its report, the board recommended that "it is appropriate to 
enhance personnel reliability measures for individuals with access to 
select agents, but promulgation of a formal, national personnel reliability 
program is unnecessary at this time." 

On February 11, 2004, DOD issued a directive (5210.88), "Safeguarding 
Biological Select Agents and Toxins" (BSAT). This directive established 
security policies and assigned responsibilities for safeguarding select 



While video monitoring addresses the threat of facility misuse to a certain extent, expert 
review of the images would be essential to determine if misuse is occurring. 

43 In 2003, we reported on the risks an insider can pose in a high-containment laboratory 
working with animal diseases. See GAO, Combating Bioterrorism: Actions Needed to 
Improve Security at Plum Island Animal Disease Center, GAO- 03-847 (Washington, D.C.: 
Sept. 19, 2003). 

44 Moreover, in reaction to the September 11, 2001, terrorist attack and the subsequent 
anthrax incidents, Congress passed several laws (for example, the USA PATRIOT Act and 
the Bioterrorism Preparedness and Response Act of 2002) to combat terrorism and, in 
doing so, significantly strengthened the oversight of select agents and increased safeguards 
and security requirements. 

45 Report of the National Science Advisory Board for Biosecurity, Enhancing Personnel 
Reliability among Individuals with Access to Select Agents (Washington, D.C.: May 2009). 
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agents and toxins. Specifically, this directive established, among other 
things, the following DOD policy: 

"Individuals who have a legitimate need to handle or use biological select 
agents and toxins, or whose duties afford access to storage and work 
areas, storage containers and equipment containing biological select 
agents or toxins shall be screened initially for suitability and reliability. 
This means that they shall be emotionally and mentally stable, 
trustworthy, and adequately trained to perform the assigned duties and 
shall be the subject of a current and favorably adjudicated National 
Agency Check with Local Agency Checks and Credit Checks for military 
and contractor employees and an Access National Agency Check with 
credit checks and written inquiries for civilian employees with a 
reinvestigation every 5 years and they shall be evaluated on a continuing 
basis using the criteria issued by the [Under Secretary of Defense for 
Intelligence.]" 

On April 18, 2006, DOD issued Instruction 5210.89, "Minimum Security 
Standards for Safeguarding Select Agents and Toxins." This instruction 
established, among other things, the criteria and requirements for 
personnel regarding a biological personnel reliability program (BPRP). 
The purpose of a BPRP is to (1) ensure that each individual, who has 
authorized access to BSAT and/or supervises personnel with access to 
biological restricted areas and BSAT, including responsible and certifying 
officials, meets the highest standards of integrity, trust, and personal 
reliability and (2) identify any potential risk to public health, safety, and 
national security. 

Following the announcement of the FBI anthrax investigation at 
USAMRIID, the Secretary of the Army organized a task force on August 7, 
2008, to evaluate the U.S. Army biological surety program, including 
safety, security, and personnel reliability. In response, the Inter-Service 
Council for Biosecurity and Biosafety, General Officer Steering 
Committee, issued a report on December 12, 2008. This report focused on 
seven areas: transportation of select agents and toxins; biological safety; 
biological security/physical security; inspection; personnel reliability 
program/foreign personnel; inventory/accountability of select agents and 
toxins; and training of personnel. Review of all seven areas indicated that 
armed service policies, regulations, standards, and procedures in effect 
before 2008 met or exceeded all federal and DOD requirements. The 
services, however, agreed on the need to establish common standards in 
each area. In addition, on March 10, 2008, the Interagency Security 
Committee Standard defined the criteria and process to be used in 
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determining the facility security level of a federal facility as the basis for 
implementing governmentwide facility security standards. 

In October 2008, the office of the Under Secretary of Defense for 
Acquisition, Technology, and Logistics asked the Defense Science Board 
Task Force on DOD Biological Safety and Security 46 to address the 
following questions: 

• Are current and proposed policies in DOD and military department 
biological safety, security, and biological personnel reliability programs 
adequate to safeguard against accidental or intentional loss/misuse of 
biological select agents and toxins (BSAT) by external or internal actors? 

• Are current DOD-related laboratories and operations that use or store 
BSAT meeting stringent standards for safety, security, and personnel 
reliability? 

• How do DOD and military department programs compare with other 
government agency, academic, and industry programs? 

• How can DOD usefully employ experience in other areas requiring the 
utmost safety and reliability when handling dangerous material (for 
example, the nuclear personnel reliability programs) for biosecurity policy 
development and implementation? 

In May 2009, the Defense Science Board published its report. With regard 
to insider risk, the report concluded that "a determined adversary cannot 
be prevented from obtaining very dangerous biological materials intended 
for nefarious purposes, if not from DOD laboratories, then from other 
sources. The best we can do is to make it more difficult. We need to 
recognize this reality and be prepared to mitigate the effects of a biological 
attack." 47 

In October 2008, the White House Office of Science and Technology Policy 
asked the National Science Advisory Board for Biosecurity (NSABB) to 
recommend strategies for enhancing personnel reliability among 



46 Memorandum for Chairman, Defense Science Board, "Defense Science Board Task Force 
on the Department of Defense Biological Safety and Security Program," (Washington, D.C, 
October 3, 2008), p.39. 

47 DOD, Report of the Defense Science Board Task Force, Department of Defense 
Biological Safety and Security Program (Washington, D.C, May 2009), p. 39. 
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individuals with access to biological select agents and toxins. Specifically, 
the NSABB was asked to identify the optimal framework for ensuring 
personnel reliability so that the need for biosecurity was balanced with 
rapid progress in the life sciences. The NSABB concluded in its report that 
"there is currently insufficient evidence of the effectiveness of personnel 
reliability program measures towards mitigating the risk of an insider 
threat to warrant the additional significant burden on research 
institutions." 48 However, the NSABB did recommend a number of ways to 
enhance the culture of research responsibility and accountability at 
institutions that conduct select agent research, noting that the 
recommended actions could be accomplished without significant 
expenditures, resources, or disruptions of research. 

On January 9, 2009, an executive order established a governmentwide 
working group to strengthen laboratory biosecurity in the United States. 49 
The executive order asked the working group to submit to the President, 
no later than 180 days after the date of the order, an unclassified report, 
with a classified annex as required, that sets forth the following: 

• "a summary of existing laws, regulations, guidance, and practices with 
respect to security and personnel assurance reviewed under subsection 
(a) of this section and their efficiency and effectiveness; 

• recommendations for any new legislation, regulations, guidance, or 
practices for security and personnel assurance for all federal and 
nonfederal facilities; 

• options for establishing oversight mechanisms to ensure a baseline 
standard is consistently applied for all physical, facility, and personnel 
security and assurance laws, regulations, and guidance at all federal and 
nonfederal facilities; and 

• a comparison of the range of existing personnel security and assurance 
programs for access to biological select agents and toxins to personnel 
security and assurance programs in other fields and industries." 



Report of the National Science Advisory Board for Biosecurity, Enhancing Personnel 
Reliability among Individuals with Access to Select Agents, May 2009, 
http://oba.od.nih.gov/biosecurity/nsabb_past_meetings.html (accessed August 5, 2009). 

49 Executive Order 13486, January 9, 2009, "Strengthening Laboratory Biosecurity in the 
United States." 
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The working group submitted its draft report and recommendations to the 
White House on July 9, 2009. According to HHS, the draft report is to be 
formally reviewed and accepted by the co-chairs — the Secretaries of 
Defense and Health and Human Services — before it is made public. 

While it may be possible to quantify the financial costs required to initiate 
and maintain enhanced oversight procedures — such as controls of 
inventories and laboratory usage — the impact of such procedures on work 
output is unquantifiable but nevertheless very real. According to some 
experts and high-containment laboratory scientists, intrusive personnel 
reliability programs can also have an adverse impact on staff work 
effectiveness. 

Accordingly, the security benefits achieved by such procedures must be 
evaluated to obtain some understanding of the cost/benefit ratio. Such an 
evaluation could incorporate various stress tests and assessments of 
procedures against a range of risk scenarios. Effective evaluation could 
improve the cost/benefit ratio by concentrating on procedures with higher 
returns on investment and could be more acceptable to laboratory 
personnel by demonstrating objective benefits. Regular reevaluation is 
critical to avoid adding oversight procedures on a subjective rather than 
objective basis. 

Inventory Procedures Did Not Impede Insider Misuse of Agents 

Prior to the fall of 2001, there were no effective inventory control 
procedures at USAMRIID — or indeed other institutions that worked with 
select agents — that would have impeded insider misuse of such agents. 
Anthrax spores were held in a liquid solution in a flask (RMR-1029) that 
originally (October 22, 1997) contained 1000 ml of spore suspension with a 
concentration of 3xl0 10 spores/ml. While the flask had been under the 
control of Dr. Mns since 1997, other laboratory staff may also have had 
access to it. However, no one in USAMRIID was specifically responsible 
for monitoring the use of materials by scientists. According to USAMRIID 
officials, Dr. Ivins's laboratory notebook contained a record of the 
amounts of material removed at various times between 1997 and 2004, 
when the FBI finally removed the flask from USAMRIID. Additional 
undocumented removals from the flask could have been disguised simply 
by adding water to restore the volume. This would have reduced the spore 
concentration, but this concentration was apparently never checked. Even 
if it had been, experts told us that the normal biological experimental error 
involved in counting spores could have disguised the loss of up to 5 
percent of the material. 
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It is unclear whether the anthrax spores put in the letters came directly 
from the flask after being dried or whether a very small and undetectable 
quantity from the flask was cultured to produce enough new spores for the 
letters. In either scenario, the self-replicating nature of microorganisms 
and the inherent error associated with determining the absolute number of 
microorganisms in solution make inventory control a formidable if not 
impossible task with currently available technologies. 50 



Actions Taken by the 
Regulatory Agency — DSAT- 
Subsequent to the Incident 



According to DSAT officials, even though Dr. Ivins' alleged crime occurred 
prior to the expansion of the select agent regulations in 2002, DSAT 
performed an extensive 2-week inspection of the entire USAMRIID facility 
in September 2008. DSAT believes that its findings regarding USAMRIID's 
inventory records contributed to the decision of DOD to stand down 
USAMRIID operations pending a thorough review of its inventories. In 
addition, DSAT referred USAMRIID to the HHS-OIG for further 
investigation regarding the entity's apparent noncompliance with the 
select agent regulations. According to HHS-OIG, this referral is still an 
ongoing investigation. 



Incident 2: Safety In 2006, a series of incidents at the high-containment laboratories at Texas 

Violations by a University A&M University (TAMU), and their aftermath, raised issues related to 

• barriers to reporting laboratory accidents, 

• inadequate and ineffective training for laboratory personnel, 

• the failure to inform medical personnel about the agents the laboratory 
staff work with, and 

• uncertainty about what constitutes a potential exposure. 

TAMU is registered with DSAT and approved for work on several select 
agents. TAMU has several BSL-3 laboratories and works extensively on 
animal diseases, including those caused by the select agents Brucella 
melitensis, Brucella abortus, and Brucella suis. Brucella can cause 



Barriers to Reporting 
Laboratory Accidents 



50 Microorganism populations are constantly in a state of flux where fractions of the total 
may be multiplying or dying off. This dynamic situation, coupled with the extraordinarily 
high numbers of organisms (billions per milliliter) and the inherent inaccuracies of assay 
methods, make it unrealistic to assign conclusive numbers to microbial populations in 
storage and working stocks. 
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brucellosis in humans, a disease causing flu-like symptoms, such as fever 
and fatigue. In severe cases, it can cause infections of the central nervous 
system. TAMU is also registered for use of Coxiella burnetii, an animal 
agent that can cause Q fever in humans. 

In February 2006, a laboratory worker from a non-select-agent laboratory 
was helping out with an experiment to aerosolize Brucella. The laboratory 
worker had no familiarity with the specifics of working with Brucella but 
did have experience working with the aerosol chamber. It was later 
determined that the laboratory worker had been exposed to the agent 
while cleaning the chamber after the experiment was run. 

At the time of the exposure, neither the exposed worker nor anyone else 
had any indication that an exposure had taken place. In fact, DSAT 
inspectors were on campus days after the Brucella exposure for a routine 
inspection but uncovered nothing that alerted them to what had 
happened. 51 Symptoms did not start to appear in the exposed worker until 
more than a month after the exposure, and then the symptoms were flu- 
like. Confirmation of brucellosis was not made until another month had 
passed and the symptoms had worsened. However, once the brucellosis 
was identified, the worker notified appropriate authorities at TAMU. But 
no report was subsequently made to DSAT (as required by federal 
regulation), and a year passed before — by chance — an independent 
watchdog group reviewing unrelated documentation 52 acquired through 
Texas's freedom of information law, uncovered the lapse in reporting. This 
prompted TAMU to notify DSAT. 

Training of Laboratory The laboratory worker at TAMU who was exposed to Brucella was not 

Personnel authorized to work with that agent. The laboratory worker was, we were 

told, being allowed in the laboratory only to help out with operating the 
aerosolization chamber. 53 According to DSAT, TAMU failed to report to 
DSAT that it was conducting aerosolization work with Brucella. Therefore, 



The CDC inspected laboratories at TAMU on February 22, 2006, and documented 47 
facility "departures" but did not note any of the violations later uncovered. 

52 The Sunshine Project, Mandate for Failure, The State of Institutional Biosafety 
Committees in an Age of Biological Weapons Research (Austin, Texas, Oct. 4, 2004). 

53 According to the CDC, even though the worker was escorted, having her help out with the 
aerosolization chamber during the Brucella experiments constituted unauthorized access 
to a select agent (since she was not authorized to work with Brucella) and violated 
regulations. 
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DSAT had no reason to verify training, experimental plans, and risk 
assessments during its inspections. 

According to select agent regulations, all staff — not only staff that have 
access to select agents or toxins, but also staff that will work in or visit 
areas where select agents are handled or stored — are required to be 
trained in the specifics of any agent before they work with it. The training 
must address the particular needs of the individual, the work they will do, 
and the risks posed by the select agents and toxins. However, the worker 
at TAMU did not receive training in the specifics of Brucella, including its 
characteristics, safe handling procedures, and potential health effects. 54 
While the worker was experienced in general BSL-3 procedures, her 
normal work regimen involved working with Mycobacterium tuberculosis, 
and her supervisor surmised that the differential in the potential for 
infection from Brucella was partially to blame for the exposure. 55 
However, experts have told us that if procedures that are effective to avoid 
exposure to live, virulent M. tuberculosis were being followed correctly, 
these should have been effective for Brucella despite the differences in the 
infectious dose (ID50). 56 

The exposed laboratory worker was highly experienced in handling 
M. tuberculosis, an infectious agent. The worker had been a laboratory 
director of a BSL-2 laboratory for the past 5 years, had a Ph.D. in 
microbiology, and was by many accounts highly competent and reliable. 
The worker applied the procedures governing safe work with 
M. tuberculosis to the Brucella experiment, but her experience with 
M. tuberculosis might have provided a false sense of security. 

Medical Provider Lacked At the time of the exposure to Brucella at TAMU on February 9, 2006, the 

Information to Diagnose laboratory worker and others in the laboratory did not realize she had 

Possible Infection Quickly been infected. In fact, DSAT conducted a routine inspection of TAMU on 

February 22, 2006 — 13 days after the exposure — but had no way of 
knowing that it had happened. According to the exposed worker, she first 



Although TAMU did not notify DSAT that it was conducting aerosolization work with 
Brucella, TAMU still had the responsibility to train the staff. 

55 Although a person typically has to breathe in M. tuberculosis bacteria to get an infection, 
Brucella can enter the system through mucous membranes, such as those in the eyes. 
During the experiment, the lab worker who was exposed had been wearing a respirator 
that filtered the air she breathed, as is recommended for work with M. tuberculosis. 

56 ID50 is the dose needed to infect 50 percent of exposed individuals. 
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fell ill more than 6 weeks after the exposure. At that time, the first 
consultation with her physician indicated that she had the flu. Institutions 
generally do not give medical providers information about the specific 
agents that laboratory staff work with. Therefore, the physician was not 
alerted to the possibility that the worker's symptoms could be the result of 
exposure to an infectious agent. After the symptoms persisted, a 
consultation with an infectious disease specialist confirmed that the 
laboratory worker's blood contained an unknown microorganism. At that 
point, the worker recalled her work with Brucella weeks earlier. The 
Texas State Public Health Laboratory confirmed the infection with 
Brucella on April 16, 2006 — 62 days after the exposure. During the interim, 
the worker had resumed her normal activities. 

By the time the diagnosis was made, the exposed laboratory worker had 
become seriously ill. The delay in recognizing the infection resulted in 
delay of appropriate treatment, thus aggravating her condition. Such a 
misdiagnosis is not uncommon with infectious diseases, as the initial 
symptoms often appear flu-like, and brucellosis is not generally endemic in 
the population. According to DSAT, the worker might have developed an 
even more severe infection, possibly affecting her central nervous system 
or the lining of her heart, if the worker had not recalled the experiment 
with Brucella and alerted her physician to this fact. The physician might 
have been able to correctly diagnose the infection more quickly if the 
physician had been informed of the agent the individual worked with. 

In this incident, it was fortunate that transmission of brucellosis beyond 
the initial exposed individual was difficult and that there was no risk of the 
infection spreading to the surrounding community. Many other agents — 
including those that are not select agents (such as SARS coronavirus and 
M. tuberculosis) — cause diseases that are transmitted from human to 
human through coughing or fluid transfer. 57 

Confusion over the Definition 
of Exposure 



In addition to the incident of exposure to Brucella, DSAT noted that 
TAMU failed to report several incidents of potential exposure to Coxiella 
burnetii — a select agent and the causative agent for Q fever in humans. 
While the Brucella exposure eventually became apparent because of 
clinical symptoms in the laboratory worker, the C. burnetii incidents 



On July 13, 2009, DSAT published a notice in the Federal Register proposing the addition 
of SARS-associated coronavirus (SARS-CoV) to the list of select agents. The Federal 
Register notice can be found at http://edocket.access.gpo.gov/2009/pdf/E9-16536.pdf 
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raised questions about what constitutes sufficient evidence of an exposure 
that the entity is required to report to DSAT. 

For C. burnetii and other agents, periodically measuring the titer or 
antibody levels within the blood serum of laboratory workers working 
with those agents provides one indication of exposure. If a person's titer 
level is higher than his or her baseline level, then it may be concluded that 
the person has been exposed to the agent. In response to the draft report, 
HHS stated that the titer should be at least four times higher than baseline 
to be considered an exposure. However, HHS did not provide any support 
for its assertion, and we could not find any scientific support for picking 
this level. 

We consider that any titer elevation where that agent is being worked with 
in the laboratory requires further detailed investigation. In addition, the 
degree of titer elevation that can be considered as definitively diagnostic 
needs to be scientifically validated on an agent-by-agent basis. However, 
there are issues with using titer levels as an indication of exposure. For 
example, determining when the exposure took place is not 
straightforward, and methods for determining titers are not standardized 
across laboratories. 

TAMU has a program to monitor blood serum for those staff working with 
C. burnetii. While humans are very susceptible to Q fever, only about one- 
half of all people infected with C. burnetii show signs of clinical illness. 
During the DSAT inspection that was triggered by the uncovering of the 
Brucella incident, DSAT came across clinical records showing that several 
laboratory workers had elevated titers for C. burnetii. No reports of this 
possible exposure had been sent to DSAT. DSAT noted this issue and, on 
April 24, 2007, TAMU submitted the required Form 3 to DSAT. 

However, as a result of subsequent discussion with the individuals who 
had the elevated titers, TAMU officials began to doubt whether the 
elevated titers resulted from exposures that had occurred at TAMU. In one 
case, TAMU said, one of the infected laboratory workers had only recently 
been hired by TAMU but had worked in a clinical laboratory in China 
where C. burnetii was known to have been present. It is not clear how the 
elevated titer related to the employee's baseline titer taken at the time of 
employment. In another case, the worker claimed to have been exposed 
many years earlier and to have always registered high, although the actual 
levels varied. DSAT officials disagreed with this interpretation and 
believed the high titers resulted from exposures at TAMU. 
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TAMU officials told us that they initially responded to the uncovering of 
the elevated titer incidents by reporting to DSAT any subsequent elevated 
titer level identified in its laboratory workers. TAMU also told us that it is 
now unsure how to proceed; it has notified DSAT that, in its opinion, an 
exposure suggested by an elevated titer should be defined as having 
occurred only after clinical symptoms appear in the individual. TAMU has, 
therefore, ceased reporting incidents where there are only elevated titers. 
In the absence of clarity over the definition of exposure, TAMU officials 
have chosen to define it as they see fit. 

DSAT officials told us that they disagreed with TAMU's interpretation. 
Reporting exposures only after clinical symptoms develop could have 
dangerous consequences for laboratory workers and even the public. 
DSAT conducted multiple follow-up inspections to assist TAMU in 
becoming compliant with the select agent regulations. In addition, on 
January 18, 2008, DSAT and APHIS posted a guidance document on the 
analysis of possible exposure incidents. 58 According to DSAT, scenario 20 
of this document specifically addresses the recommended response to an 
elevated antibody titer in a select agent worker. DSAT officials noted that 
reporting exposures only after clinical symptoms develop — given the 
requirements of the select agent regulations and the guidance provided in 
the theft, loss, and release guidance document — would be considered a 
violation of the select agent regulations. 

Lessons Learned: Barriers to 
Reporting, Compliance with 
Regulations Regarding 
Training, Informing Medical 
Providers, and Defining 
Exposure 



Barriers to Reporting Need to Be Identified and Overcome 

According to the literature and discussions with federal officials and 
experts, accidents in laboratories do occur, mostly as a result of human 
error due to carelessness, inadequate training, poor judgment, fatigue, or a 



The common theme in the TAMU incidents was a lack of rigor in applying 
fundamental safety and training procedures coupled with a culture that 
embodied a reluctance to be open about problems both within the 
organization and with the regulator. According to our experts, such 
cultural reticence has historically been a factor in many previous incidents 
and can be remedied only by appropriate leadership at the highest level of 
the organization coupled with robust and continued action by the 
regulator. 



° See www.selectagents.gov/resources/CDC- 
APHIS_Theft_loss_Release_Information_Document.pdf. 
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combination thereof. 59 In the case of theft, loss, occupational exposure, or 
release of a select agent, the laboratory must immediately report certain 
information to DSAT or APHIS. 

It has been suggested that there is a disincentive to report laboratory- 
acquired infections and other mishaps at research institutions because it 
could result in (1) negative publicity for the institution and the worker or 
(2) scrutiny from a granting agency that might lead to a suspension of 
research or an adverse effect on future funding. 60 

In order to enhance compliance with reporting requirements, barriers 
need to be identified, and targeted strategies need to be applied to remove 
those barriers. The literature identifies a number of barriers, including 

• the lack of explicit standardized protocols; 

• the lack of effective training on protocols; 

• the lack of awareness that infection may have been laboratory-acquired; 

• reporting systems that may have required individuals to pass through 
layers to reach the biosafety office (e.g., the supervisor, laboratory 
manager, or principal investigator); 

• fear of punitive measures at the laboratory or institutional level; 

• individual or institutional embarrassment; 

• a poor relationship with medical support services (such as occupational 
safety and health services); and 

• the lack of useful investigation/follow-up/feedback. 



For additional information, see E.J. Baron and J. M. Miller, "Bacterial and Fungal 
Infections Among Diagnostic Laboratory Workers: Evaluating the Risks," Diagnostic 
Microbiology and Infectious Diseases, epub; D.L Sewell, "Laboratory-Associated 
Infections and Biosafety," Clinical Microbiology Reviews, Vol. 8, No. 3 (1995); R.M. Pike et 
al., "Continuing Importance of Laboratory Acquired Infections," American Journal of 
Public Health, Vol. 55, No. 2 (February 1965). 

60 High-Containment Biodefense Research Laboratories, Meeting Report and Center 
Recommendations, Biosecurity and Bioterrorism, vol. 5, 1 (New Rochelle, N.Y., March 
2007). 
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In addition, these incidents need to be analyzed so that (1) biosafety can 
be enhanced by shared learning from mistakes and (2) the public can be 
reassured that accidents are thoroughly examined and the consequences 
of an accident are contained. One possible mechanism for analysis 
discussed in the literature is the reporting system used for aviation 
incidents that is administered by the National Transportation Safety Board 
and the Federal Aviation Administration. 61 When mistakes are made, they 
are analyzed and learned from without being attributed to any one 
individual. Although experts have agreed that some form of personal 
anonymity would encourage reporting, it is not clear how this mechanism 
would be applied to high-containment laboratories where, for example, 
one may not know about the exposure or whether the event is significant 
enough to be reported. 

Compliance with Regulations Regarding Agent- and Experimental 
Task-Specific Training Is Needed to Ensure Maximum Protection 

The select agent regulations require safety risk assessments whenever 
work with select agents is proposed. Risk assessments are of paramount 
importance because the investigator, management, and biosafety 
representatives must establish guidelines for safe, secure, and efficient 
research. Personnel working with select agents need training to ensure 
their own safety and that of coworkers and the surrounding community. 
Training is specifically designed to address select agent characteristics 
that include infectivity and pathogenicity. Training must also address 
hazardous operations such as intentional aerosolization, centrifugation, 
and homogenization. Some laboratories require inexperienced workers to 
be mentored by personnel experienced in containment procedures, a 
process that can take up to a year to complete. The mentor maintains a 
checklist of important operations that must be performed in a responsible 
manner before the worker will be allowed to work independently. Non- 
laboratory personnel who require access to high-containment laboratories 
(inspection, maintenance, and calibration staff) must also receive training 
that covers emergency response and agent-specific information. 

If TAMU had provided effective, measurable staff training — including 
protocol-specific training on agent characteristics for Brucella (infectivity 



Department of Transportation, Federal Aviation Administration, FAA Procedures for 
Handling National Transportation Safety Board Recommendations (Washington, D.C., 
Federal Aviation Administration, March 22, 1995). Also see Federal Aviation 
Administration, Accident and Incident Data (Washington, D.C., Sept. 29, 2006). 
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and pathogenicity), common routes of infection, and medical signs and 
symptoms information — the worker might have been more aware of the 
dangers involved when cleaning the aerosol chamber and could have been 
protected from this exposure. Typical routes of infection differ for M. 
tuberculosis and Brucella, and normal procedures, including gowning and 
respiratory equipment, vary for the two agents. For example, the 
laboratory worker wore protective glasses, but they were not tight fitting. 
Experts told us that if procedures that are effective to avoid exposure to 
live virulent M. tuberculosis were being followed correctly, these should 
have been effective lor Brucella despite the difference in the infectious 
dose. 

According to an expert who has managed high-containment laboratories, 
there are risks involved in working alternately in BSL-2 and BSL-3 
laboratories with their different levels of procedures and practices. 
Laboratory workers may develop a routine with BSL-2 procedures that 
may be difficult to consciously break when working with the more 
dangerous agents and activities requiring BSL-3 containment. Adequate 
training can help to minimize the risks involved. 

Standardized Mechanisms for Informing Medical Providers about 
the Agents Laboratory Staff Work with Must Be Developed 

Severe consequences for the worker can result from delays in 
(1) recognizing when an exposure has occurred or (2) medical providers 
accurately diagnosing any resulting infection. Further, if the worker 
acquires a disease that is easily spread through contact (direct physical 
and/or respiratory), there can also be severe consequences for the 
surrounding community. 

According to the BMBL, the incidents causing most laboratory-acquired 
infections are often accidental and unknown. Those involved can conclude 
that an exposure took place only after a worker reports illness — with 
symptoms suggestive of a disease caused by the relevant agent — some 
time later. An infected person may be contagious for weeks until clinical 
symptoms become apparent. It is important that exposure be identified as 
soon as possible so that proper diagnosis and prompt medical treatment 
can be provided. To do so, medical providers need to be informed, in a 
standardized way, of all the agents that laboratory staff work with. 

The issue of recognizing exposure and infection is not new, and 
organizations have put in place systems and procedures that, while not 
infallible, greatly facilitate such recognition. As part of the oversight 
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process, a review and evaluation of such procedures and their 
effectiveness are likely to be beneficial. 

Current Confusion over the Definition of Exposure Needs to Be 
Addressed 

According to our experts, a system that requires documentation of all 
accidental releases of select agents by whatever means and ensures that 
this information is available to the inspecting/oversight authority would 
provide both a valuable database and the foundation for any further 
investigation. Any accidental release in an area where unprotected 
personnel are present should then be considered a de facto exposure and 
be immediately reported to the oversight authority whether or not there is 
any resulting infection. Laboratory personnel who contract any infection, 
even if there is no evidence of exposure, should inform their physician 
about their work, including details of the specific agent(s) that they work 
with. 

When we asked DSAT officials about the confusion over the definition of 
an exposure, they agreed that the terms need to be clearly defined and 
stated that they were drafting new guidance. 62 DSAT officials noted, 
however, that it is unwise to wait until clinical symptoms appear before 
determining that an exposure has taken place, as this could potentially 
endanger a worker's life and, in the case of a communicable disease, the 
lives of others. A DOD and NIH expert on this issue told us that correctly 
interpreting the meaning of elevated titers — whose characteristics can 
vary by agent, host, and testing laboratory — is challenging since many 
serological testing methods have not been validated. 



According to DSAT, their "concern was not necessarily with TAMU's interpretation of the 
titers, but rather, that TAMU lacked an effective surveillance system. An elevated titer may 
result in the conclusion that the person was exposed to the agent. However, the entity must 
perform a follow-up investigation to determine if the elevated titer is the result of: (1) 
previous exposure to the organism prior to work at the entity; (2) possible exposure to the 
organism while doing non-work-related activities; or exposure at the workplace." 
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To help clarify any confusion about what is considered a reportable theft, 
loss, or release, CDC released a new guidance document. 63 Scenario 20 in 
this document is an attempt to provide a simple approach by identifying 
three possible explanations for an elevated titer. However, it fails to go far 
enough and should state that an elevated titer of an agent that is being 
worked with in the laboratory should be regarded as prima facie evidence 
of exposure unless and until proved otherwise. Although clinical samples 
should then be taken at once to look for evidence of active infection, 
treatment of the person, as appropriate, should begin without delay to 
protect the health of the individual and, in some cases, safeguard the 
wider community. 

Serological testing is an indirect diagnostic tool suggesting, but not 
proving, exposure to an agent and is typically used to direct follow-up with 
more conclusive tests. Because elevated titers can be due to reasons other 
than active infection with a particular agent, the results need to be treated 
with caution. Nevertheless, an elevated antibody titer in cases where that 
agent is being worked with in the laboratory must always be a matter of 
concern and action. 

Serological testing is not definitive and scenario 20 does not provide clear 
guidance with regard to follow-up actions. Accordingly, standard 
operating procedures need to be developed by the institutions working 
together with biosafety officers/responsible officials and occupational 
health physicians to describe the appropriate course of action when 
elevated titers are observed. 

The use of serological testing as a method to identify potential exposures 
to select agents must be approached with a high degree of caution. First, 
guidelines must be very clear regarding the intended use of any serology- 
based screening program. If routine screening indicates elevated antibody 
titers against a specific pathogen over baseline levels, it may suggest a 
laboratory exposure to a pathogen; however, alternative explanations are 
also feasible. The increase in titers may indicate natural exposure to the 
agent (depending on the agent and location of the laboratory). The 
increase could also result from inconsistencies associated with laboratory 
testing. Most serological assays for select agents are not commonly 



This document is available on the National Select Agent Registry Web site: 
http://www.selectagents.gov/resources/CDC-APHIS_Theft_Loss_Release_Information_Doc 
ument.pdf 
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conducted in clinical laboratories and are mostly performed in research 
laboratories. As such, these assays may not be properly controlled and 
validated. Assay-to-assay variation may be high, especially if experience is 
limited. Additionally, such assays are not particularly robust unless 
baseline specimens are available for comparison testing and serum 
samples are collected at relatively short intervals (for example, 3 to 6 
months). 



Similarly, a serological screening program used as a method to diagnose 
infection or prevent the spread of contagious pathogens to the community 
is unlikely to be successful unless samples are taken at short intervals, as 
elevated antibody titers are usually detected after the period of maximum 
contagiousness of most pathogens. Therefore, the most appropriate use 
for a serological screening program would be to identify past exposures 
and to facilitate remedial training or conduct retrospective risk analyses 
that might lead to improved risk mitigation procedures and policies that 
might prevent future exposures. It is critical that guidance on the use of 
blood screening programs clearly identify the purpose of these programs 
and also provide guidance on how information from these programs 
should be used. Any suspicion of exposure should be reported and 
investigated, and the result of that investigation should be reported, thus 
providing a complete picture for DSAT and reducing subjective bias in 
reporting. 

The development of scientifically sound and standardized methods of 
identifying exposure is critical so that individual laboratory owners are not 
left to determine for themselves what is and what is not reportable. DSAT 
and APHIS could provide specific guidance on exposure benchmarks for 
each of the different select agents and toxins. 

Actions Taken by the 
Regulatory Agency — DSAT 
Subsequent to the Incident 



On April 20, 2007, DSAT issued a cease-and-desist order suspending work 
with Brucella species at TAMIL On June 30, 2007, DSAT suspended all 
work with select agents at TAMU. The DSAT concerns included whether 
TAMU had a plan to prevent unauthorized access to select agents and 
toxins and a program that provided effective medical surveillance of 
occupational exposures to select agents and toxins. DSAT conducted a 
comprehensive site review and released a report in August 2007 that 
detailed a long list of safety violations, including instances in which the 
school did not immediately report or neglected to report laboratory 
worker infections or exposure to Brucella or C. burnetii. It also extended 
the suspension of research with select agents until the university 
addressed the issues in the August report. 
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HHS's Office of Inspector General (OIG) imposed a fine on TAMU for the 
select agent violations. The HHS OIG was delegated authority to impose 
civil monetary penalties of up to $250,000 against an individual and up to 
$500,000 against any other person, including any entity. 64 The HHS OIG 
and TAMU disagreed on the number of violations. In February 2008, TAMU 
agreed to pay a $1 million fine, which was an unprecedented amount for a 
fine paid by any institution under the select agent program. 



Incident 3: Power Failures 
at CDC's High- 
Containment Laboratories 



Continuity of electrical power is vital for the safe functioning of high- 
containment laboratories, in particular since maintenance of essential 
pressure differentials using electrically driven fans provides an important 
barrier for preventing the uncontrolled release of agents. 65 Lapses in 
electrical power that occurred at a CDC laboratory raise concerns about 
standards in high-containment laboratory facility design, management of 
construction, and operations. 66 



On June 8, 2007, the CDC campus in Atlanta experienced lightning strikes 
in and around its new BSL-4 facility, and both the Georgia Power-supplied 
primary power and CDC-supplied backup power from its centrally-located 



"42 U.S.C. § 262a(i) (Bioterrorism Act); 42 C.F.R. § 73.21. 

65 For ease of reading, we have chosen not to include technically detailed descriptions of 
CDC's primary and backup power systems. For further information concerning the general 
requirements of backup power, please see (1) National Fire Protection Association, NFPA 
70, National Electric Code 2008 Edition (Quincy, MA) (a) "Article 700 Emergency Systems;" 
(b) "Article 701 Legally Required Standby Systems;" and (c) "Article 702 Optional Standby 
Systems" and (2) National Fire Protection Association, NFPA 110, Standard for Emergency 
and Standby Power Systems 2005 Edition (Quincy, MA). 

66 In commenting on our draft report, CDC stated that lapses in electrical power are highly 
likely regardless of the cause and type of laboratory or facility being served. CDC, as a 
result, employs an integrated approach combining laboratory procedures/training, health 
and safety protocols, and engineering/facility controls. CDC stated that the BMBL treats 
engineering controls for high-containment laboratories as secondary containment. 
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generator plant were unavailable. 67 The high-containment laboratory 
facility, not operational at the time, was left with only emergency battery 
power — which can provides limited electrical power for functions such as 
emergency lighting to aid in evacuation. Among other things, the outage 
shut down the high-containment laboratory's negative air pressure 
system. 68 While investigating the power outage, the CDC later determined 
that, some time earlier, a critical grounding cable buried in the ground 
outside the building had been cut by construction workers digging at an 
adjacent site. The cutting of the grounding cable, which had hitherto gone 
unnoticed by CDC facility managers, compromised the electrical system of 
the facility that housed the BSL-4 laboratory. 69 With the grounding cable 
cut, the lightning strikes caused the circuit breakers in the building's 
switchgear to disengage or open, resulting in a loss of primary power to 
the building. In addition, when the circuit breakers disengaged, the CDC's 
backup generators were electrically isolated from the building and could 
not supply the building with power. It took approximately an hour for the 
CDC facility staff to reset the circuit breakers in the building to reengage 
the primary power. 

Because of the June 2007 power outage incident, questions about the 
design of the backup power system for the new facility resurfaced. When 
the CDC designed the backup power system for the new BSL-4 facility, it 
decided to use diesel generators centralized at CDC's utility plant that also 



In commenting on our draft report, CDC stated that "as a consequence of the lightning 
strike, building 18 immediately experienced a blackout except for areas served from the 
uninterruptible power system (UPS) for the building. CDC operational staff immediately 
responded to the loss of power by following operational protocols that require the operator 
to investigate the possible cause of power loss and resetting over-current devices, if 
necessary, to restore normal or backup power, if required, to the building. After performing 
a brief survey of building systems and areas, CDC operational staff proceeded to the 
electrical switchgear room located on the triple sub-basement of building 18. CDC 
operational staff noticed that both 480 main breakers for the building were in a tripped 
status. The operator attempted to manually reset both tripped main breakers without 
success, whereupon the operator determined both breakers were restricted-open per 
system safety interlock. Upon further analyses and review, CDC determined that both main 
breakers tripped on ground fault current in excess of set limits. After a thorough review of 
the electrical system, the main breakers were reset and power was restored at the building 
in approximately 1 hour." 

68 The laboratory's negative air pressure system is fan-operated and is designed to prevent 
potentially contaminated air from leaving the lab without first being treated to neutralize 
the contamination. 

69 A subsequent third-party investigation determined that the grounding of another building 
housing CDC's older BSL-4 laboratories was also compromised in a similar fashion. 
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serve other facilities, as well as functions such as chillers, on the campus. 
According to internal documents provided to us, during the design phase 
for the facility, some CDC engineers had questioned the choice of this 
remotely placed, integrated design rather than a simpler design using local 
backup generators near the BSL-4 facility. 

According to CDC facility officials, the full backup power capabilities for 
the new BSL-4 facility were not in place at the time of the power outage 
but were awaiting completion of other construction projects on campus. 
Once these projects are completed, these officials said, the new BSL-4 
facility will have multiple levels of backup power, including the ability to 
get power from a second central utility plant on campus, if needed. But 
some CDC engineers that we talked with questioned the degree of 
complexity in the design. They worried that an overly integrated backup 
power system might be more susceptible to failure. As a result of the 
power outage, CDC officials conducted a reliability assessment for the 
entire campus power system, which included the backup power design for 
the new BSL-4 facility. CDC concluded that its existing centrally located 
generators and planned power-related construction projects with 
equipment upgrades were more reliable and cost-effective than scenarios 
that locate generators at individual buildings. 

CDC officials reported that its backup power system is tested monthly, as 
required by building code. In commenting on our draft report, CDC 
provided studies and data that showed the theoretical reliability of the 
power system. However, CDC could not provide us documentation of 
actual non-testing instances where the backup generator system operated 
as designed. This incident highlighted the risks inherent in relying on 
standard building codes to ensure the safety of high-containment 
laboratories — as there are no building codes and testing procedures 
specifically for high-containment laboratories. 

In a second incident, on Friday January 4, 2008, CDC officials told us that 
nearby construction again damaged the grounding system of the building 
containing the new BSL-4 facility. The damage was observed when it 
occurred, but the cable was not repaired until the following week. While 
there was no loss of power to the BSL-4 facility, the potential for repeating 
a grounding-related power failure existed until repairs were made. 

According to CDC officials, at the time of both incidents, the new BSL-4 
facility in building 18 was in preparation to become fully operational. No 
laboratory work of any kind had been conducted inside the BSL-4 
laboratories, and no live agents were inside the facility as the 



Page 60 



GAO-09-574 High-Containment Laboratories 



commissioning process was still ongoing and the laboratories were not 
activated. However, given that the grounding cables were cut, it is 
apparent that the building's integrity as it related to adjacent construction 
was not adequately supervised. Further, according to CDC officials, 
standard procedures under building codes do not require monitoring of 
the integrity of the electrical grounding of the new BSL-4 facility. CDC has 
now instituted annual testing of the electrical grounding system as the 
result of its review of these incidents. 70 

According to CDC officials, a third incident occurred on July 11, 2008, 
when a bird flew into the high voltage side of one of the Georgia Power 
transformers on the CDC campus, causing a failure in the primary 
electrical power supplied to buildings containing BSL-3 facilities. The 
CDC's backup generators did not provide power because of the cascading 
effects of a failure by one of the generators. As in the June 2007 incident, 
the facilities were left with only temporary battery power, shutting down 
the fans powering the facility's negative air pressure system. The generator 
problems were corrected by CDC in approximately an hour, at about the 
same time that Georgia Power completed its repairs and primary electrical 
power was restored. 71 

Lessons Learned: BSL -3 and -4 
Laboratory Safety Measures 
Must Be Commensurate with 
the Level of Risk These 
Laboratories Present 



In any workplace building — regardless of the nature of its activities — there 
are safety features to protect the physical safety of workers. Various 
building codes cover many aspects of building design and construction 
required to achieve this safety objective, but the codes are subject to local 
interpretation. In general, the building codes enable (1) personnel to safely 
evacuate and (2) rescue personnel or firefighters to perform their jobs. By 
definition, additional hazards beyond those anticipated by standard 
building codes potentially exist in high-containment laboratories (BSL-3 



In commenting on the draft report, CDC stated that while directional airflow and negative 
pressure in BSL-4 laboratories are crucial engineering components of a normal "safe" 
operating environment, engineering systems do fail from time to time for various reasons. 
Therefore, CDC relies on a "three-legged" approach to biocontainment (combining 
laboratory procedures/training, health and safety protocols, and engineering controls) to 
ensure that material is not released outside. Details on CDC's approach are included in 
appendix VI. We agree that the three-legged approach offers multiple layers of 
containment; however, CDC does not address the point we are making about the 
weaknesses we have identified in its electrical system. 

''Power failures can also occur intentionally. We reported in 2003 on suspicious power 
failures at a high-containment laboratory working with foreign animal diseases. See 
GAO-03-847, 20-21. 
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and BSL-4), and they are addressed in BMBL. However, according to CDC 
and NIH, BMBL is only advisory. 

BMBL contains principles and guidelines, but the document does not 
provide specific detail on how functional requirements are to be translated 
into design solutions. According to our experts, there have been instances 
where modifications to laboratories were required after construction to 
achieve the necessary compliance. A more active, early, and continuing 
dialogue between builders, operators, and regulators may be beneficial in 
avoiding such waste and is especially relevant where tax dollars are 
committed to the creation or upgrading of high-containment laboratories. 

Because BMBL addresses issues relating to maintaining the containment 
of biological agents to protect both workers and the wider public, its 
guidelines are potentially more restrictive than the building codes. 
According to our expert panel, a clear and unambiguous set of standards 
stating the various capabilities that are required to maintain the integrity 
of all high-containment laboratories is necessary. Such a set of standards 
will need to integrate building codes with the BMBL provisions or 
amendments thereto. These standards should be national — not subject to 
local interpretation — and address the possibility that one or more 
emergency or backup systems may fail. Most importantly, any set of 
scenarios aimed at maintaining containment integrity must be empirically 
evaluated to demonstrate its effectiveness. Adequate oversight of any 
nearby activities — such as adjacent construction with its potential to 
compromise buried utilities — must also be taken into consideration when 
evaluating the safety measures required to manage the risks of high- 
containment laboratories. 

The CDC's BSL-4 laboratory was designed with multiple layers of 
electrical power so that if primary power failed, a secondary source of 
power would be in place for continuity of operations. Failure to monitor 
the system's integrity, however, compromised the ability of either power 
source to support critical operations. The power outages at CDC 
demonstrate a need to create understanding throughout the organization 
that effective biosafety involves layers of containment and, furthermore, 
that the loss of any one layer is serious even though the remaining layers, 
as intended, do maintain containment. Thus, procedures are required to 
regularly assess the functional integrity of every layer of containment and 
to initiate immediate corrective actions as required. The fact that taken as 
a whole, containment is being maintained is not a sufficient measure of 
system integrity: each component must be individually assessed and its 
operational effectiveness validated on a regular schedule. 
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Actions Taken by the 
Regulatory Agency — DSAT — 
Subsequent to the Incident 



According to DSAT, since the CDC laboratory was not registered under 
the select agent regulations at the time of the incident, no DSAT action 
was required. 72 



Incident 4: Release of 
Foot-and-Mouth Disease in 
the United Kingdom 



High-containment laboratories are highly sophisticated facilities that 
require specialized expertise to design, construct, operate, and maintain. 
Because these facilities are intended to contain dangerous 
microorganisms, usually in liquid or aerosol form, even minor structural 
defects — such as cracks in the wall, leaky pipes, or improper sealing 
around doors — could have severe consequences. Supporting 
infrastructure, such as drainage and waste treatment systems, must also 
be secure. 



In August 2007, foot-and-mouth disease contamination was discovered at 
several local farms near Pirbright in the U.K., the site of several high- 
containment laboratories that work with live foot-and-mouth disease virus. 
Foot-and-mouth disease is one of the most highly infectious livestock 
diseases and can have devastating economic consequences. For example, 
a 2001 epidemic in the U.K. cost taxpayers over S3 billion, including some 
£1.4 billion paid in compensation for culled animals. 73 Therefore, U.K. 
government officials worked quickly to contain and investigate this recent 
incident. 



Lesson Learned: Facilities 
Supporting High-Containment 
Laboratories Must Ensure the 
Operational Effectiveness of 
Physical Infrastructure 



The investigation of the physical infrastructure at the Pirbright site found 
evidence of long-term damage and leakage of the drainage system 
servicing the site, including cracked and leaky pipes, displaced joints, 
debris buildup, and tree root ingress. While the definitive cause of the 
release has not been determined, it is suspected that contaminated waste 
water from Pirbright's laboratories leaked into the surrounding soil from 
the deteriorated drainage pipes and that live virus was then carried off-site 
by vehicles splashed with contaminated mud. 



' On May 27-30, 2008, DSAT inspected this laboratory, which included a review of the 
incident response plan in the event of a power outage. On October 8, 2008, DSAT approved 
this laboratory for registration. 

' 3 See Department for Environment, Food, and Rural Affairs, Foot and Mouth Disease: 
Applying the Lessons (London, U.K., National Audit Office, Feb. 2, 2005). We also reported 
on this 2001 U.K. incident. See GAO, Foot and Mouth Disease: To Protect U.S. Livestock, 
USDA Must Remain Vigilant and Resolve Outstanding Issues, GAO-02-808 (Washington, 
D.C.: July 26, 2002). 
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The cracked and leaky pipes found at Pirbright are indicative of poor 
maintenance practice at the site. The investigation found that (1) 
monitoring and testing for the preventive maintenance of pipe work for 
the drainage system was not a regular practice on-site and (2) a 
contributing factor might have been a difference of opinion over 
responsibilities for maintenance of a key pipe within the drainage system. 

High-containment laboratories are expensive to build and expensive to 
maintain. Adequate funding for each stage needs to be addressed. 
Typically, in large-scale construction projects, funding for initial 
construction comes from one source, but funding for ongoing operations 
and maintenance comes from another. For example, NIAID recently 
funded 13 BSL-3 laboratories as regional biocontainment laboratories 
(RBL) and 2 BSL-4 laboratories as national biocontainment laboratories 
(NBL). According to NIAID, it contributed to the initial costs for planning, 
design, construction, and commissioning and provided funding to support 
the operation of these facilities. For these laboratories, the universities are 
partially responsible for funding maintenance costs. 74 

The Pirbright incident shows that beyond initial design and construction, 
ongoing maintenance plays a critical role in ensuring that high- 
containment laboratories operate safely and securely over time. Because 
even the smallest of defects can affect safety, ensuring the continuing 
structural integrity of high-containment laboratories is an essential 
recurring activity. 

The failure of part of the physical infrastructure at the U.K.'s Pirbright 
facility and the outbreak of foot-and-mouth disease highlight the 
importance of ongoing maintenance of such facilities, together with clear 
lines of responsibility regarding shared infrastructure facilities. In 
addition, this incident and other incidents emphasize the importance of 
regulators and laboratories working in partnership to either ensure that 
funding to maintain the infrastructure is available or alter work programs 
and eliminate activities that cannot be performed safely. 



In commenting on our draft report, NIAID noted that the cooperative awards were made 
to the NBLs in fiscal year 2006 to "develop and maintain the research resources and 
facilities needed to meet national, regional, and local biodefense and emerging infectious 
diseases research needs." NIAID plans to continue support for these awards. 
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Actions Taken by the U.K. Since the outbreak of foot-and-mouth disease originating from Pirbright, a 

Regulatory Agency Subsequent number of regulatory decisions have been made: 
to the Incident 

1. The U.K. government undertook a review of the regulatory framework 
governing work with animal pathogens that resulted in a November 
2007 report. The government accepted all the report's 
recommendations, which included (1) moving regulation of work with 
animal pathogens from Defra to HSE and (2) developing a single 
regulatory framework covering work with human and animal 
pathogens based on the model provided by the Genetically Modified 
Organisms (Contained Use) Regulations 2000. This framework adopts 
a risk-based approach to regulation. 



2. The Specified Animal Pathogens Order (SAPO) was amended in April 
2008 to give inspectors increased powers, including the power to serve 
improvement and prohibition notices on entities (called duty holders 
in the U.K.) to remedy poor standards in such areas as containment 
and management. At the same time, HSE entered into an agency 
agreement with Defra to inspect premises where work with SAPO 
agents is carried out before Defra issues licenses; the license 
conditions are based on recommendations from HSE. Furthermore, 
HSE inspectors investigate any accidents and also proactively inspect 
facilities to ensure compliance with the license conditions. 

3. Both organizations at Pirbright (Institute for Animal Health (IAH) and 
Merial) had their licenses amended or withdrawn following the 
outbreak. The IAH license was amended to allow diagnostic work (in 
the epidemiology building) and a limited amount of research in the 
arbovirology building. No animal work has been licensed to date, 
although new animal house facilities are nearing completion, and work 
may be licensed later this year. 

4. All the drainage systems on-site have been tested and relined, and a 
new dual containment system has been laid to connect laboratories to 
a refurbished heat treatment plant. This new system is not yet 
operational, although it is in the final stages of commissioning. In the 
meantime, no laboratory or manufacturing effluent is discharged to the 
relined drainage system unless it has been heat treated by autoclaving 
(IAH) or been through a validated heat treatment cycle (Merial). The 
only effluent going to the drain and to the final chemical treatment 
plant is shower water, which should not contain virus as all activities 
are carried out in cabinets or in enclosed systems. 
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5. A newly refurbished building on the IAH has recently been licensed to 
allow small scale research on a number of SAPO 4 viruses. 

6. Merial was fully relicensed following amendments to its procedures 
and joint Defra and HSE inspections. The new licenses are more 
detailed than the original versions and impose many more license 
conditions on the company. 

7. No enforcement action has been taken against either organization 
following the outbreak of foot and mouth disease. The enforcing body 
(part of the local council) decided that there was insufficient evidence 
to prosecute either IAH or Merial. 



High-containment laboratories provide facilities that are needed for basic 
research, development of detection technologies, and diagnostic and 
medical countermeasures for biothreats. Accordingly, facilities are 
specialized and cannot easily be converted from one function to another. 
Medium- to long-term advance planning for the appropriate capacity levels 
is therefore essential, as is knowledge of existing capacity. Such advance 
planning needs to take into account the (1) projected future balance 
between biodefense and more traditional public health work, (2) the 
specific infectious disease problems and targets that the expansion is 
meant to address, and (3) targets for the laboratory expansion's timetable 
or benchmarks as to when specific capacities need to be available. We 
were unable to identify any governmentwide strategic evaluation of these 
issues for high-containment laboratories. 

Furthermore, since no single agency is in charge of the current expansion, 
no one is determining the associated aggregate risks posed by the 
expansion. As a consequence, no federal agency can determine whether 
high-containment laboratory capacity may now be less than, meet, or 
exceed the national need or is at a level that can be operated safely. 

If an agency were tasked or a mechanism were established with the 
purpose of overseeing the expansion of high-containment laboratories, it 
could develop a strategic plan to (1) ensure that the number and 
capabilities of potentially dangerous high-containment laboratories are no 
greater or less than necessary, (2) balance the risks and benefits of 
expanding such laboratories, and (3) determine the type of oversight 
needed. 
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Such an agency or mechanism could analyze the biothreat problems that 
need to be addressed by additional BSL-3 and -4 laboratories, the scientific 
and technical capabilities and containment features that such laboratories 
need to have, how the laboratories should be distributed geographically, 
and how the activities of the laboratories would be coordinated to achieve 
intended goals. 

Standards for several key issues have not been developed. The agency or 
mechanism responsible for overseeing the expansion of high-containment 
laboratories could also be responsible for coordinating with the scientific 
community to develop guidelines for high-containment laboratory design, 
construction, and commissioning and training standards for laboratory 
workers; providing definitions for exposure; developing appropriate 
inventory control measures; and providing guidance on the most efficient 
approach to personnel reliability programs. 

The oversight agency or mechanism could also address issues related to 
the ongoing funding needs of high-containment laboratories. While NIAID 
has provided funding to build RBLs and NBLs, these laboratories are 
expected to compete for funding from NIH to sustain their research. It is 
unclear what will happen to these facilities, their trained personnel, and 
their technology if no such funding is available. Further, as these facilities 
and other high-containment laboratories age, adequate funding sources 
must be identified for upgrades and maintenance, or the risks that they 
pose may outweigh their benefits. 

Once laboratories have been commissioned and begin operating, 
continuing maintenance and testing/validation programs are needed to 
ensure that operating standards and regulatory compliance are 
maintained. As facilities age, the costs of such programs will rise and are 
likely to consume an increasing proportion of budgets. Although this 
affects federal, industrial, and academic laboratories, the impact is likely 
to be greatest on academic laboratories. Although federal laboratories are 
subject to annual funding, they tend to have programs that have long-term 
commitments and are not usually subject to major changes even if 
principal investigators (scientists) relocate. Industrial laboratories exhibit 
similar stability of operations once they are committed to projects and 
programs. In all these cases, maintenance budgets are less tied to funding 
for research than are those of academic laboratories, which are highly 
dependent on research grant funding to support both infrastructure 
maintenance as well as research programs. Indeed, the two activities may 
compete for available money. Relocation of a principal investigator who is 
the recipient of research grant funding can create problems for the 
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institute in maintaining the laboratory facilities. Given the high costs of 
creating high-containment laboratories, consideration also needs to be 
given to the issue of their maintenance and support as distinct from 
funding for research activity. 

The four incidents at USAMRIID, TAMU, CDC, and Pirbright exemplify a 
number of failures of systems and procedures that are meant, in 
combination, to maintain the biosafety of high-containment laboratories to 
protect laboratory workers and the public. DSAT and APHIS could 
examine these incidents and apply the lessons learned across the program. 

These incidents have been described and analyzed in detail both because 
they are recent and because detailed information was available about the 
various factors involved. Unfortunately, the incidents and their causal 
factors are not unique, and the scientific literature contains information 
about many incidents occurring over decades that often involved similar 
factors and the failure to maintain adequate biosafety. 

Overall, the safety record of high-containment laboratories has been good, 
although a number of weaknesses have become apparent over time. 
Consequently, along with expansion there needs to be a commensurate 
development of both operational and oversight procedures to address 
known deficiencies and, as far as practicable, proactively evaluate future 
risks. 

Laboratory operators, in collaboration with regulators, need to develop 
and work through potential failure scenarios and use that information to 
develop and put in place mechanisms to challenge procedures, systems, 
and equipment to ensure continuing effectiveness. 



We recommend that the National Security Advisor, in consultation with 
the Secretaries of Health and Human Services (HHS), Agriculture (USDA), 
Defense (DOD), and Homeland Security (DHS); the National Intelligence 
Council; and other executive departments as deemed appropriate identify 
a single entity charged with periodic governmentwide strategic evaluation 
of high-containment laboratories that will 

(1) determine 

• the number, location, and mission of the laboratories needed to effectively 
meet national goals to counter biothreats; 



Recommendations for 
Executive Action 
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• the existing capacity within the United States; 

• the aggregate risks associated with the laboratories' expansion; and 

• the type of oversight needed 

and (2) develop, in consultation with the scientific community, national 
standards for the design, construction, commissioning, and operation of 
high-containment laboratories, specifically including provisions for long- 
term maintenance. 

We recommend that the Secretaries of HHS and USDA develop (1) a clear 
definition of exposure to select agents and (2) a mechanism for sharing 
lessons learned from reported laboratory accidents so that best 
practices — for other operators of high-containment laboratories — can be 
identified. 

Should the Secretaries consider implementing a personnel reliability 
program for high-containment laboratories to deal with insider risk, we 
recommend that they evaluate and document the cost and impact of such 
a program. 

Recognizing that biological agent inventories cannot be completely 
controlled at present, we also recommend that the Secretaries of HHS and 
USDA review existing inventory control systems and invest in and develop 
appropriate technologies to minimize the potential for insider misuse of 
biological agents. 



We obtained written comments on a draft of our report from the 
Secretaries of HHS and USDA. The Executive Office of the President: 
National Security Council did not provide comments. HHS and USDA 
concurred with our recommendations that were directed to them (see 
appendixes VII and VIII). HHS officials also provided general comments, 
including some concerns that are discussed in appendix VII. In addition, 
DOD, HHS, and USDA officials provided technical comments, which have 
been addressed in the body of our report, as appropriate. 



Agency Comments 
and Our Evaluations 
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We are sending copies of this report to the Executive Office of the 
President; the Attorney General; and the Secretaries of Agriculture, 
Defense, Health and Human Services, and Homeland Security. In addition, 
the report will be available at no charge on the GAO Web site at 
http://www.gao.gov. 

If you or your staffs have any questions about this report, please contact 
me at (202) 512-2700 or kingsburyn@gao.gov or Sushil K. Sharma, Ph.D., 
Dr.PH, at (202) 512-3460 or sharmas@gao.gov. Contact points for our 
Offices of Congressional Relations and Public Affairs may be found on the 
last page of this report. GAO staff who made major contributions to this 
report are listed in appendix IX. 




Nancy Kingsbury, Ph.D. 
Managing Director, Applied Research 
and Methods 
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Chairman 

The Honorable Susan M. Collins 

Ranking Member 

Committee on Homeland Security 

and Governmental Affairs 
United States Senate 

The Honorable Henry A. Waxman 
Chairman 

The Honorable John D. Dingell, Jr. 
Chair Emeritus 
The Honorable Joe Barton 
Ranking Member 

Committee on Energy and Commerce 
House of Representatives 

The Honorable Bart T. Stupak 
Chairman 

The Honorable Greg Walden 
Ranking Member 

Subcommittee on Oversight and Investigations 
Committee on Energy and Commerce 
House of Representatives 

The Honorable Darrell E. Issa 
Ranking Member 

Committee on Oversight and Government Reform 
House of Representatives 

The Honorable John F. Tierney 
Chairman 

The Honorable Jeff Flake 
Ranking Member 

Subcommittee on National Security and Foreign Affairs 
Committee on Oversight and Government Reform 
House of Representatives 
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The Honorable Daniel E. Lungren 
Ranking Member 

Subcommittee on Emerging Threats, Cybersecurity, 

and Science and Technology 
Committee on Homeland Security 
House of Representatives 

The Honorable Michael T. McCaul 
Ranking Member 

Subcommittee on Intelligence, Information Sharing 

and Terrorism Risk Assessment 
Committee on Homeland Security 
House of Representatives 

The Honorable David E. Price 
Chairman 

Subcommittee on Homeland Security 
Committee on Appropriations 
House of Representatives 

The Honorable Richard Burr 
United States Senate 

The Honorable John Linder 
House of Representatives 
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Appendix I: Scope and Methodology 



To determine the extent of expansion in the number of high-containment 
laboratories and the areas experiencing growth, we interviewed agency 
officials and experts and reviewed documents provided by agencies and 
scientific literature. To determine which federal agency has the mission to 
track and determine the aggregate risks associated with the proliferation 
of BSL-3 and BSL-4 laboratories in the United States, we surveyed 12 
federal agencies that are involved with these laboratories in some 
capacity — for example, research, oversight, or monitoring. 

The survey requested information on whether the agency (1) has a mission 
to track the number of high-containment laboratories, (2) has a need to 
know the number of operating BSL-3 and BSL-4 laboratories, and 
(3) knows that number. The agencies that received our survey included 
the Department of Agriculture; the Department of Commerce; the 
Department of Defense; the Department of Energy; the Environmental 
Protection Agency; the Department of Health and Human Services, 
including the Centers for Disease Control and Prevention (CDC); the 
Department of Homeland Security; the Department of the Interior; the 
Department of Justice, including the Federal Bureau of Investigation; the 
Department of Labor, including the Occupational Safety and Health 
Administration; the Department of State; and the Department of Veterans 
Affairs. In addition, we sent our survey to intelligence agencies, including 
the Central Intelligence Agency, the National Counter-Terrorism Center, 
the Defense Intelligence Agency, and the Office of Intelligence Analysis 
within DHS. 

To supplement existing information on the current number of BSL-3 and 
BSL-4 laboratories in the United States, we surveyed 724 individuals, who 
were identified through various open sources as knowledgeable contacts 
on biosafety laboratories, through a self-administered electronic 
questionnaire posted on the World Wide Web between April 2007 and May 
2007. We obtained responses from 295 respondents, for an overall 
response rate of 41 percent. Several important limitations should be noted 
about our survey. First, the universe of BSL-3 and -4 laboratories is 
unknown. While we used multiple sources to develop our list of potential 
respondents, there are likely other laboratories that we were unable to 
identify. Second, there may be duplicate responses in cases where 
multiple persons responded to the survey for a single institution. The data 
from our questionnaire are sufficiently reliable to demonstrate that there 
are BSL-3 or -4 laboratories that do not work with select agents. 

We also met with officials of the Division of Select Agents and Toxins and 
the Animal and Plant Health Inspection Service to gain additional 
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Appendix I: Scope and Methodology 



information about the expansion of high-containment laboratories. Finally, 
we reviewed documents these agencies provided, including pertinent 
legislation, regulations, and guidance, and reviewed scientific literature on 
risks associated with high-containment laboratories. 

To develop lessons learned from recent incidents at four high-containment 
laboratories, we interviewed academic experts in microbiological research 
involving human, animal, and plant pathogens and conducted site visits at 
selected federal, civilian, military, academic, and commercial BSL-3 and 
BSL-4 laboratories, including the sites involved in the recent incidents. 
Specifically, we conducted site visits at CDC and Texas A&M University 
(TAMU); talked to United Kingdom officials at the Health Safety Executive 
and the Department for Environment, Food, and Rural Affairs; and 
reviewed documents and inspection reports. 

To discuss the incidents at TAMU and CDC, we conducted site visits and 
interviewed the relevant officials. During our site visit to CDC, we 
interviewed relevant officials, including the officials of CUH2A, Inc. — the 
contractor who designed the backup power system for the new BSL-4 
laboratory in Atlanta — as well as the expert hired by this firm to conduct 
the reliability study for the backup power system. 

We conducted our work from September 2005 through June 2009 in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 
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Appendix II: Expert Panel 



The expert panel that reviewed this report comprised scientists with 
substantive expertise in microbiological and select agent research and the 
operations of high-containment laboratories. The following were the panel 
members: 

Peter Emanuel, Ph.D. 

Office of Science and Technology Policy 

Executive Office of the President 

Gigi Kwik Gronvall, Ph.D. 

Center for Biosecurity of the University of 

Pittsburgh Medical Center 
University of Pittsburgh 

George V. Ludwig, Ph.D. 

U.S. Army Medical Research and Material Command 
Ft. Detrick, Maryland 

Jack Melling, Ph.D., Retired 

U.K. Microbiological Research Authority 

Porton Down, United Kingdom 

Alan Jeff Mohr, Ph.D., Retired 
Life Sciences Division 
U.S. Army, Dugway Proving Ground 
Tooele, Utah 

Suresh D. Pillai, Ph.D. 
Texas A&M University 
College Station, Texas 

Janet Shoemaker 

American Society for Microbiology 
Washington, D.C. 
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Appendix III: List of Select Agents and Toxins 
as of November 17, 2008 



HHS Select Agents and Toxins 

Abrin 

Botulinum neurotoxins 

Botulinum neurotoxin producing species of Clostridium 
Cercopithecine herpesvirus 1 (Herpes B virus) 

Clostridium perfringens epsilon toxin 
Coccidioides posadasii/Coccidioides immitis 
Conotoxins 
Coxiella burnetii 

Crimean-Congo haemorrhagic fever virus 

Diacetoxyscirpenol 

Eastern Equine Encephalitis virus 

Ebola virus 

Francisella tularensis 
Lassa fever virus 
Marburg virus 
Monkeypox virus 

Reconstructed 1918 Influenza virus 1 
Ricin 

Rickettsia prowazekii 
Rickettsia rickettsii 
Saxitoxin 

Shiga-like ribosome inactivating proteins 
Shigatoxin 

South American Haemorrhagic Fever viruses 
Flexal 
Guanarito 
Junin 
Machupo 
Sabia 

Staphyloccoccal enterotoxins 
T-2 toxin 

Tetrodotoxin 

Tick-borne encephalitis complex (flavi) viruses 
Central European Tick-borne encephalitis 
Far Eastern Tick-borne encephalitis 
Kyasanur Forest disease 



1 Reconstructed replication competent forms of the 1918 pandemic influenza virus 
containing any portion of the coding regions of all eight gene segments. 
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Appendix III: List of Select Agents and Toxins 
as of November 17, 2008 



Omsk Hemorrhagic Fever 
Russian Spring and Summer encephalitis 
Variola major virus (Smallpox virus) and 
Variola minor virus (Alastrim) 

Yersinia pestis 

USDA Select Agents and Toxins 

African horse sickness virus 
African swine fever virus 
Akabane virus 

Avian influenza virus (highly pathogenic) 

Bluetongue virus (exotic) 

Bovine spongiform encephalopathy 

Camel pox virus 

Classical swine fever virus 

Ehrlichia ruminantium (Heartwater) 

Foot-and-mouth disease virus 

Goat pox virus 

Japanese encephalitis virus 

Lumpy skin disease virus 

Malignant catarrhal fever virus (Alcelaphine herpesvirus type 1) 
Menangle virus 

Mycoplasma capricolum subspecies capripneumoniae (contagious 

caprine pleuropneumonia) 
Mycoplasma mycoides subspecies mycoides small colony (MmmSC) 

(contagious bovine pleuropneumonia) 
Peste des petits ruminants virus 
Rinderpest virus 
Sheep pox virus 
Swine vesicular disease virus 

Vesicular stomatitis virus (exotic): Indiana subtypes VSV-IN2, VSV-IN3 
Virulent Newcastle disease virus 2 

Overlap Select Agents and Toxins 

Bacillus anthracis 
Brucella abortus 



2 A virulent Newcastle disease virus (avian paramyxovirus serotype 1) has an intracerebral 
pathogenicity index in day-old chicks (Gallus gallus) of 0.7 or greater or has an amino acid 
sequence at the fusion (F) protein cleavage site that is consistent with virulent strains of 
Newcastle disease virus. A failure to detect a cleavage site that is consistent with virulent 
strains does not confirm the absence of a virulent virus. 
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Appendix III: List of Select Agents and Toxins 
as of November 17, 2008 



Brucella melitensis 
Brucella suis 

Burkholderia mallei (formerly Pseudomonas mallei) 

Burkholderia pseudomallei (formerly Pseudomonas pseudomallei) 

Hendra virus 

Nipah virus 

Rift Valley fever virus 

Venezuelan Equine Encephalitis virus 

USDA Plant Protection and Quarantine (PPQ) Select Agents and 
Toxins 

Peronosclerospora philippinensis (Peronosclerospora sacchari) 

Phoma glycinicola (formerly Pyrenochaeta glycines) 

Ralstonia solanacearum race 3, biovar 2 

Schlerophthora rayssiae var zeae 

Synchytrium endobioticum 

Xanthomonas oryzae pv. Oryzicola 

Xylella fastidiosa (citrus variegated chlorosis strain) 
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Appendix IV: Biological Agents 
Recommended for BSL-3 Containment That 
Are Not Select Agents 



There are a number of biological agents causing severe illness or death 
that are not select agents. Some non-select-agents are recommended for 
work, research, and production safely under BSL-2 containment (BMBL, 
5th Edition). These agents are listed in table 11. Several of these non- 
select-agents may require BSL-3 containment for specific reasons, 
including production of aerosols or large-scale production of these 
organisms (BMBL, 5th Edition). These agents are listed in table 12. 



Table 11: Agents Requiring BSL-2 Containment, Rarely BSL-3 Containment 


Agent 


Disease 


Bordetella pertussis 


pertussis (whooping cough) 3 


Neisseria gonorrhoeae 


gonorrhea 


M 


meningitis, septicemia 


Salmonella typhi 


typhoid fever" 


Hepatitis B, C, D viruses 


hepatitis B a , hepatitis C, hepatitis D 


Human herpes virus 


herpes simplex etal. 


Lyssaviruses 


rabies 3 


Retroviruses 


HIV 


Source: BMBL, 5th Edition. 




"These agents currently have vaccines available to the public. 


Table 12: Agents Typically Requiring BSL-3 Containment 


Agent 


Disease 


Chlamydia psittaci 


psittacosis 


Hanta virus 


Hanta virus pulmonary syndrome 


Mycobacterium tuberculosis complex tu be rc u los is 


Non-contemporary human influenza Strains H2N2 influenza 


(H2N2) 




Lymphocytic choriomeningitis virus 


aseptic meningitis, encephalitis 


SARS coronavirus 


SARS a 


West Nile virus 


"West Nile virus" encephalitis 



Source: BMBL, 5th Edition. 



a C DC has proposed that this agent be added to the select agents and toxins list. 
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Appendix V: The Army's Requirements for 
High-Containment Laboratories in 2001 



According to DOD officials, DOD did not have a policy document specific 
to biological select agents and toxins (BSAT) or high-containment 
laboratories in 2001. 

In 2001, all U.S. Army high-containment laboratories working with select 
agents were registered with CDC (under 42 C.F.R. § 72.6). Army safety 
regulations in place at that time required the following: 

1. A hazard analysis must be conducted to determine safety precautions, 
necessary personnel protection, engineering features, and procedures to 
prevent exposure for all agents. The Army utilized the risk analysis 
technique of maximum credible events, which examines the consequences 
of realistic worst-case scenarios. 

2. Facilities must have standard operating procedures, training and 
proficiency requirements, medical surveillance, emergency preparedness 
procedures (including advance notification to local, state, regional, and 
federal emergency response personnel), hazard labeling, disposal and 
maintenance controls, and protective equipment for all work with agents. 

3. Quarterly inspections for biosafety level (BSL)-l and BSL-2 laboratories 
and monthly inspections for BSL-3 and BSL-4 laboratories must be 
conducted. 

4. All mishaps must be reported and investigated. Medical surveillance of all 
workers present must begin immediately after a mishap. 

5. Access control procedures were required to keep people not needed to 
operate biological laboratories from entering. 

6. Federal, state, and local laws must be obeyed when transporting agents. 

7. Components that contract out biological defense work must prepare 
written procedures that set guidelines for facilities, safety, inspections, and 
risk analysis. They were also required to monitor contractor performance 
in meeting safety requirements, which includes pre-award inspections, 
annual inspections of BSL-3 facilities and semiannual inspections of BSL-4 
facilities, documentation of safety training programs, designation of an 
individual responsible for safety, and storage and disposal procedures. 
Contractors working at BSL-3 and BSL-4 facilities must prepare a plan for 
controlling laboratory mishaps. 

8. Facilities must have published safety plans and monitoring procedures that 
they coordinated with federal, state, and local emergency services and 



Page 80 



GAO-09-574 High-Containment Laboratt 



Appendix V: The Army's 
Requirements for High- 
Containment Laboratories in 
2001 



practiced with emergency groups. An occupational health program, 
including medical surveillance examinations, was also required. 

9. The regulations also set out operational requirements, including laboratory 
techniques, based on biosafety level, and emergency procedures, such as 
establishing evacuation procedures and an emergency alarm system. 

10. Facilities must abide by personal protective equipment requirements 
(based on biosafety level), decontamination and disposal requirements and 
shipping restrictions, and facility specifications based on biosafety level 
and engineering controls. 

These regulations are located at 32 C.F.R., parts 626 and 627. Army 
pamphlet 385-69 also prescribes the minimum safety criteria and technical 
requirements and is used in conjunction with these regulations. 1 
Additionally, since USAMRIID was designated a "restricted area" in 1995, a 
National Agency Check was also required for general unescorted access 
for all staff. The USAMRIID Special Immunizations Clinic provided 
baseline medical and occupational health evaluations of fitness to work in 
the laboratories and provided vaccines. Annual medical interviews, 
physical exams, and laboratory reassessments were conducted for changes 
in health, medication, and duties. 

According to information provided to us by USAMRIID, security clearance 
was not and is not required to work in high-containment laboratories, and 
having a security clearance did not by itself allow access to high- 
containment laboratories. In 2001, there was no centralized requirement 
for inventory control and accountability. Individual scientists maintained 
their own stocks and accountability. 

CDC's regulations in 2001 (42 C.F.R. § 72.6) focused on the transfer of 
select agents and thus did not focus on personnel security or insider risk 
or inventory control of select agents. While Army regulations required that 
the consequences of realistic worst case scenarios be examined, insider 
risk was not considered in such examinations. 



'in 2007, Army regulation 385-10, the Army Safety Program, provided policies on safety that 
included biological safety. 
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In commenting on the draft report, HHS officials stressed the importance 
of the Centers for Disease Control and Prevention's (CDC) integrated 
"three-legged approach" to biocontainment at high containment 
laboratories. They provided the following technical details of their 
biocontainment experiences. 

"According to CDC officials, monitoring one-pass directional airflow 
through negatively pressurized containment zones, enclosed and 
separated by airtight doors and structure, with HEPA filtration on both the 
supply side (one HEPA filter) and the exhaust side (two HEPA filters), 
along with robust Operations and Maintenance protocols (O&M) provides 
a sound facility design and construction component for CDC's 'three- 
legged' approach to biocontainment. This approach, which is described in 
Section II of the BMBL, stresses that laboratory practice and technique is 
the most important element of a comprehensive containment strategy, in 
conjunction with appropriate safety equipment (as a primary barrier) and 
facilities design/construction and engineering (as a secondary 
containment barrier). CDC maintains that while directional airflow and 
negative pressure in BSL-4 laboratories is a critical engineering 
component of a normal 'safe' operating environment, engineering systems 
do fail from time-to-time, for various reasons. 

"In the event of a loss of power to the supply and exhaust fans and 
controls that maintain negative pressure conditions in CDC's BSL-4 
laboratories, the laboratories go to a 'static pressure' status, whereby 
secondary containment is maintained by the airtight door gaskets, airtight 
construction of interior walls, floors, and ceiling within the BSL-4 
laboratory block, and because the HEPA filters on the supply side and 
exhaust ducts are functionally impermeable to air for certain periods of 
time under static pressure conditions. In effect proper design, 
construction and O&M render the CDC BSL-4 laboratories into airtight 
boxes during a complete loss of normal and standby power during these 
events. Containment was also preserved because CDC's laboratorians are 
properly trained in safe laboratory practices and procedures, and BSL 
equipment and safety protocols (primary barriers) functioned as intended. 
Equipment within the BSL-4 laboratories include biological safety 
cabinets, centrifuges, and heavy-duty personal protective suits (i.e., 'space 
suits'). 

"In the lightning and bird strike incidents outlined above [see pp. 58-61], 
secondary engineering controls failed due to temporary construction- 
related impacts, rather than typical operations conditions, and all but UPS- 
generated life safety required power was lost in B [building] 18. However, 



Page 82 



GAO-09-574 High-Containment Laboratories 



Appendix VI: CDC's Integrated Approach to 
Biocontainment at High-Containment 
Laboratories 



because CDC had appropriated and effective laboratory practice and 
safety equipment and practices in place, and because a static pressure 
condition had been maintained (as a secondary barrier), the chance of an 
accidental release of dangerous pathogens into the environment so as to 
cause a significant risk to CDC workers or the surrounding community did 
not exist. 

"According to CDC officials, the lightning and bird strike incidents are not 
typical of O&M-related incidents that CDC has experienced over the years 
since they are directly related to the intense construction activities at the 
Roybal Campus that have been ongoing since approximately 2000, and are 
expected to largely conclude in approximately 2011. The construction 
activities are the execution of the Agency's 10-Year Master Plan to replace 
the many 50-year old buildings, including laboratories and infrastructure 
at the Roybal and Chamblee Campuses. CDC date [data] indicates that 
even with the lightning and bird strike incidents, the Roybal Campus 
electrical distribution system has had a 99.9997 percent reliability rate, or 
approximately 10 hours of documented down-time due to power outages 
during 78,840 hours of total run time (2000-2008). CDC expects to reduce 
electrical system downtime once construction activities have ceased." 
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DEPARTMENT OF HEALTH & HUMAN SERVICES 



Assistant Secretary tor Legislation 
Washington, DC 20201 



OFFICE OF THE SECRETARY 



JUL 8 * 2009 



Note: GAO comments 
supplementing those in 
the report text appear at 
the end of this appendix. 



Nancy Kingsbury, Ph.D. 

Managing Director 

Applied Research and Methods 

U.S. Government Accountability Office 

441 G Street N. W. 

Washington, DC 20548 

Dear Ms. Kingsbury: 

Enclosed are comments on the U.S. Government Accountability Office's (GAO) report entitled: "HIGH- 
CONTAINMENT LABORATORIES: Coordinated National Oversight is Needed" (GAO-09-574). 

The Department appreciates the opportunity to review this report before its publication. 



Sincerely, 




Barbara Pisaro Clark 

Acting Assistant Secretary for Legislation 



Attachment 
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GENERAL COMMENTS FROM THE DEPARTMENT OF HEALTH AND HUMAN SERVICES 
(HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE'S (GAP) DRAFT REPORT 
ENTITLED, "HIGH-CONTAMINMENT LABORATORIES: COORDINATED NATIONAL 
OVERSIGHT IS NEEDED" (GAO-09-574) 

The Department of Health and Human Services (HHS) thanks GAO for the opportunity to review and 
comment on this draft report. HHS concurs with GAO's recommendations that have been directed to the 
Secretary of HHS and respectfully submits the following comments about the report. 



Knowing the Total Number of All BSL-3 Laboratories Could be Beneficial But Has Not Been 
Mandated 



See comment 1. 



See comment 2. 



See comment 3. 



In the section titled, "BSL-3 Labs Are Being Built in All Sectors Throughout the United States," GAO 
implies that the Centers for Disease Control and Prevention (CDC) should know the total number 
Biosafety Level-3 laboratories (BSL-3 laboratories) in the United States. Though it could be beneficial to 
know where all the BSL-3 laboratories are located across the country, it is important to point out 
prominently in this report that there is no executive or legislative mandate directed at any federal agency 
to know this information. The select agent programs at CDC and the United States Department of 
Agriculture (USDA)/ Animal and Plant Health Inspection Service (APHIS) know the identity and location 
of all laboratories (BSL-2, BSL-3, and BSL-4) that possess, use, or transfer select agents, which is a 
tremendous data resource. They maintain this information because it was required by the Public Health 
Security and Bioterrorism Preparedness and Response Act of 2002. However, there is no such reporting 
requirement for laboratories that do not work with select agents. Knowing information about the location 
of all BSL-3 laboratories could be beneficial, but instituting new regulatory reporting requirements 
possibly could create a burden on private sector laboratories and would require new federal resources. To 
this end, HHS will recommend to appropriate entities to engage in a more in-depth policy debate on this 
issue. 

Suggestions for Presenting Information About Power Outages at CDC 

Because it does not appear that the report includes some important details that were provided in 
previously submitted responses, comments, and other written documents, HHS does not concur with 
GAO's assessment of Incident 3 and GAO's related findings. 

We urge GAO to point out that the lightning strike that occurred on June 8, 2007 on CDC's campus 
affected BSL-4 laboratories that were not yet operational; no laboratory work of any kind had been 
conducted inside the BSL-4 laboratories in Building 18 prior to the lightening strike incident. In addition, 
no infectious pathogens were stored in this space because the commissioning process was still ongoing 
and the laboratories were not yet activated. It is important to note that there was never a threat to any 
laboratory workers, CDC employees, or the public. Conveying this information is critical so that readers 
will have a clear understanding about the outage. 

We also urge GAO to note that even if the laboratories had been operational, there still would not have 
been any threat of exposure to any laboratory workers, CDC employees, or the public. The draft report 
currently does not discuss a very important facility design approach that ensures biocontainment, which is 
an approach that is embraced by CDC and implemented in the design and operations of the Building 18 
high-containment laboratory. This approach is the "multi-tiered," or integrated "three-legged" 
containment, method that stresses three components: (1) laboratory practice and technique; (2) 
appropriate safety equipment as a primary containment barrier; and (3) facilities design, construction, and 
engineering as a secondary containment barrier. 

2 
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ENTITLED. "HIGH-CONTAMINMENT LABORATORIES: COORDINATED NATIONAL 
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The approach, which is described in Section II of Biosafety in Microbiological and Biomedical 
Laboratories 5 th edition (BMBL), stresses that laboratory practices and techniques are the most important 
elements of a comprehensive containment strategy. CDC maintains that all three components are 
necessary when analyzing the effectiveness of biocontainment in BSL laboratories and that no single 
component failure will necessarily constitute the loss of containment. Although this detail was covered 
during meetings with GAO and would be beneficial to include, this information is not currently reflected 
in the report. 

See Comment 4. We do question GAO's assessment that problems with primary power failures of BSL-4 laboratories 

could have "devastating consequences" (Lessons Learned section for Incident 3). Because it is unclear 
how GAO defines "devastating," it may be overstating the problem about the impact of a loss of power. 
All air in a BSL-4 laboratory is filtered before entering both the inside and outside environments and the 
workers in the laboratory are protected from aerosols through the positive pressure suits or sealed 
biological safety cabinets. Please note that the systems are designed to maintain containment, and many 
system components are redundant and overlapping. Thus, the loss of one component does not necessarily 
result in loss of overall containment. 

SeeC0mment5. Also, the draft report should include several important details regarding the critical differences, purpose, 

and functions differentiating code-required emergency power and legally required standby power. These 
differences are important when planning and designing electrical distribution systems for biological 
laboratories and other science buildings and should be carefully considered when performing an analysis 
of such a system. Comments and other written data concerning this topic were provided to GAO. 

Serological Testing Can Indicate an Exposure if Interpreted Properly 

In discussing the Texas A&M University incident, the GAO report addresses the issue of using 
serological testing to monitor potential exposures to select agents. When used properly, serological 
testing can be an effective method for detecting exposures to infectious agents, including select agents. A 
serum titer that is higher than a baseline titer is not necessarily considered an exposure. The rise in titer is 
SeeC0mment6. the most important aspect of identifying infection, assuming that a pre-exposure serum is also tested. The 

titer should be at least 4 times higher than a baseline to be considered an exposure, and the timeframe in 
which the testing was done (relative to the baseline) is also important. Antibody titers generally rise after 
clinical symptoms appear. Many nuances to the proper interpretation of serological testing exist (e.g., the 
appropriate use and interpretation of these tests; and identification of type of antibody [IgM and IgG]). 
All of these factors need to be considered to best interpret serological testing. Before finalizing findings 
and conclusions on this issue, GAO may find it helpful to get assistance from specialists in serological 
testing. 

The report also indicates that more guidance is needed for the regulated community in using this method. 
CDC and APHIS jointly developed the Select Agents and Toxins Theft, Loss and Release Information 
Document to provide guidance to the regulated community on what constitutes an occupational exposure 
to a select agent, including guidance on the interpretation of serological testing 
(http://www.selectagents.gov/resources/CDC-APHIS_Theft 



3 
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However, the Select Agents and Toxins Theft, Loss and Release Information Document is not the only tool 
used by the HHS and USDA select agent programs to communicate with registered entities on 
occupational health issues such as serological testing: As part of the oversight process, select agent 
programs routinely review occupational health plans. In addition, select agent liaisons are routinely 
available to discuss occupational health issues with responsible officials and other members of the 
regulated community. 

Recommendations for the National Security Advisor 

HHS is committed to working with the National Security Advisor should a government-wide, strategic 
evaluation of high-containment laboratories be undertaken. 

See Comment 7. To inform this discussion, we note that national goals to counter biothreats may change over time. 

Laboratories are built to last 50 years or longer, so assessing whether current laboratory capacity will be 
appropriate for future needs is difficult. A BSL-3 laboratory can be used for BSL-2 work, but it is 
impossible, without renovating it, to use a BSL-2 laboratory for BSL-3 work. Therefore, it is more 
desirable to build for the maximum biosafety containment that is anticipated (e.g., BSL-3) while using a 
realistic estimate for future needs (e.g., more than 50 years). Otherwise, it would be impossible to work 
with highly pathogenic microorganisms — such as severe acute respiratory syndrome (SARS) — quickly. 

See C0mment8. ^* ne ma y nee ^ to reconsider the suggestion that an oversight organization could address the needs and 

distribution of laboratories, and coordinate the intended goals, because the needs will change yearly. 
Coordination may not be easy because federal agencies have different agendas, timelines, and budgets. 

The issue of how many laboratories should exist and where these laboratories should be located is 
complex. It is important to consider the uses of such laboratories in the future. For example, having a 
BSL-3 laboratory available in an institution is considered a bonus when it needs to be used quickly for 
new and emerging needs such as SARS. It is essential to have laboratory capacity for optimizing 
emergency response and public health threats. However, the overall need should be determined by taking 
into account the ability to respond effectively and quickly to natural and manmade infectious-disease 
emergencies across a wide region or area; the ability to create new science around the identification, 
characterization, and control of re-emerging or novel infectious-disease threats; and the ability to quickly 
develop appropriate countermeasures. 

This report may not identify all gaps in high-containment laboratory facilities in clinical settings, 
including large community hospitals and tertiary-care facilities. Many believe that these types of clinical 
See C0mment9. facilities often have inadequate containment measures for certain high-risk work. Expansion of 

laboratories does not automatically mean that too many laboratories exist, nor does it mean that the 
distribution and supply of existing high-containment laboratories is adequate or optimum. Any future 
evaluations of capacity and supply should examine the needs of the clinical laboratories related to their 
high-containment capacity. 

GAO recommends that the National Security Advisor identify a single entity to evaluate high- 
containment laboratories. This entity should not only validate the number and capacity of the laboratories 
(to determine whether these factors are appropriate and meet the needs of the country), but identify the 
risks and determine what kind of oversight is needed. 
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See comment 10. 



GENERAL COMMENTS FROM THE DEPARTMENT OF HEALTH AND HUMAN SERVICES 
(HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE'S (GAP) DRAFT REPORT 
ENTITLED. "HIGH-CONTAMINMENT LABORATORIES: COORDINATED NATIONAL 
OVERSIGHT IS NEEDED" fGAO-09-574) 

Regarding the concern of risks associated with expanding high-containment laboratories and their 
resulting capacity, such risks should be carefully balanced by (1) the rewards associated with the 
enhanced epidemiology and surveillance capacity; (2) the improved ability to respond to emergencies; 
and (3) the improved ability to mitigate outbreaks and control infectious diseases. 

An amazing success story is the expansion of the Laboratory Response Network (LRN) during the past 
decade: now all 50 states, the District of Columbia, and several territories have BSL-3 capabilities. This 
development has been crucial in ensuring a safer and more robust response capability, and it has clearly 
enhanced our ability to identify, characterize, and respond to public health threats. Specifically, the LRN 
has greatly enhanced our response to seasonal influenza, H5N1, SARS, white-powder and toxin events, 
threat letters, and novel H1N1 influenza A virus. 

GAO also recommends that there be a government-wide effort to develop national standards for 
designing, constructing, commissioning, and operating high-containment laboratories. Some national 
standards for design, construction, commissioning, and operation of these laboratories have been included 
in the BMBL. However, it may be more beneficial to share lessons learned in the trade than to create 
standards, which may not apply in all situations. In addition, many of these laboratories are already 
constructed and being maintained, so it would need to be determined how such standards would apply to 
them. 



Recommendations for the Secretary of HHS 



GAO Recommendation: We recommend that the Secretaries of HHS and USDA develop (1) a clear 
definition of exposure to select agents; and (2) a mechanism for sharing lessons learned from reported 
laboratory accidents so that best practices can be identified and shared with other operators of high- 
containment laboratories. 



HHS Response: HHS agrees that it is important for select-agent registered entities to have a clear 
understanding of what constitutes an exposure to select agents. CDC's and APHIS' select agent programs 
have seriously considered the issue of select agent exposures. The APHIS/CDC Select Agents and Toxins 
Theft, Loss and Release Information Document that was published on January 18, 2009, contains a 
definition for occupational select agent exposures (http://www.selectagents.gov/resources/CDC- 
APHIS_Theft_Loss_Release_Information_Document.pdf). This definition, which is derived from the 
occupational exposure definition in the OSHA Bloodborne Pathogens Standard (29 CFR Part 1910- 
1030b), is as follows: 



"Occupational exposure: Any event which results in any person in a registered entity 
facility or lab not being appropriately protected in the presence of an agent or toxin. This 
may include reasonably anticipated skin, eye, mucous membrane, or parenteral contact 
with blood or other potential infectious materials that may result from the performance of a 
person's duties. For example, a sharps injury from a needle being used in select agent or 
toxin work would be considered an occupational exposure." 



5 
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The Select Agents and Toxins Theft, Loss and Release Information Document will also assist the regulated 
community in analyzing incidents for select agent exposures. Through 20 possible scenarios, it describes 
how this definition is applied to incidents that may occur in select agent facilities. We will review the 
Select Agents and Toxins Theft, Loss and Release Information Document and consider adding the 
occupational health response recommendations in Scenario 20. 

HHS also agrees that lessons learned from laboratory accidents should be synthesized and shared with the 
broader laboratory community. The APHIS/CDC Form 3 collects information on thefts, losses, and 
releases of select agents. CDC will work with APHIS to synthesize the data that have been gathered 
about releases in laboratories registered with the select agent programs, and it will publish and share this 
analysis in a public report. Please note that HHS and USDA have the ability to gather such data only for 
laboratories that work with select agents. A separate mechanism must be identified to gather information 
about releases in laboratories that do not work with select agents. 

GAO Recommendation: Should the Secretaries consider implementing a personnel-reliability program 
for high-containment laboratories to address insider risk, we recommend that they evaluate and document 
the cost and impact of such a program. 

HHS Response: HHS agrees that there must be a careful analysis of the costs, risks, and benefits of 
personnel-reliability programs before such a requirement is instituted for the select agent program. The 
Working Group on Strengthening the Biosecurity of the United States, established by Executive Order 
13486 and signed by President George W. Bush on January 9, 2009, also addresses this issue. The draft 
report was provided to the White House on July 9, 2009. HHS will work with its partners at USDA to 
carefully evaluate the value, feasibility, cost, and impact of implementing such a program. As part of the 
evaluation, HHS and USDA will consider the recommendations from this working group regarding 
personnel-reliability programs. 

GAO Recommendation: Recognizing that biological agent inventories cannot be completely controlled 
right now, we also recommend that the Secretaries of HHS and USDA review existing inventory-control 
systems and invest in and develop appropriate technologies to help minimize the potential risk for an 
insider to misuse biological agents. 

HHS Response: HHS agrees that inventory-control systems must be improved to minimize the potential 
risk for an insider to misuse biological agents. The Select Agent Regulations include requirements related 
to maintaining inventory logs of select agents. However, some have called for additional guidance from 
the select agent programs on requirements related to working stocks versus select agents that are held long 
term in storage. CDC's and APHIS' select agent programs have worked together to provide registered 
entities with additional guidance on the inventory requirements for working stocks and select agents that 
are held long term in storage. On February 12, 2009, CDC's and APHIS' select agent programs posted 
guidance on the definition of "long-term storage" as used in the Select Agent Regulations. This guidance 
is available on the National Select Agent Program's website at the following address: 
http://www.selectagents.gov/complianceAssistance.htm. Also, we will carefully review any 
recommendations regarding inventory control from the Working Group on Strengthening the Biosecurity 
of the United States and consider how to implement those recommendations. 
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The following are GAO's responses to the Department of Health and 
Human Service's (HHS) comments in a letter dated July 20, 2009. 



q A q Comments ^ 6 a ^ ree w ^ HHS. Our report acknowledges that no executive or 

' " A " legislative mandate currently requires any agency to gather this 

information and we are making a recommendation in this regard. 

2. We agree that instituting new regulatory reporting requirements about 
the location of all BSL-3 laboratories could create a burden on private 
sector laboratories and would require new federal resources. 

3. Our report did acknowledge information from CDC officials stating 
that at the time of both incidents, the new BSL-4 facility was not fully 
operational and that no agents were inside the facility. However, we 
believe that CDC is missing the point. Given that grounding cables 
were cut, it is apparent that the building's integrity as it related to 
adjacent construction was not adequately supervised. CDC officials 
stated that standard procedures under building codes did not require 
monitoring of the integrity of the new BSL-4 facility's electrical 
grounding. This incident highlighted the risks inherent in relying on 
standard building codes to ensure the safety of high-containment 
laboratories — as there are no building codes and testing procedures 
specifically for those laboratories. We agree with CDC that high- 
containment laboratories include a three-legged and multi-tiered 
approach to containment. However, to have a fully safe system of 
containment, any failure of one tier or one of the legs needs to be 
rapidly identified and corrected. Our focus in this incident was on 
CDC's power system and lessons that can be learned for other high- 
containment labs. 



4. We modified the language in our report to note that a loss of power 
could have serious consequences under certain circumstances. 

5. While we agree that critical differences, purposes, and functions 
differentiating code-required emergency power and legally required 
standby power are important when planning and designing electrical 
distribution systems for biological laboratories and other science 
buildings, this does not materially affect our findings. 

6. We disagree with CDC that the titer should be at least four times higher 
than the baseline level to be considered an exposure. Most 
importantly, any increase in titers involving an agent that is being 
worked on at a laboratory should be taken seriously and investigated. 
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The laboratory safety aspect of antibody titers is clearly different from 
those that apply to a general clinical situation. The increase in titers 
may indicate natural exposure to the agent (depending on the agent 
and location of the lab) or result from inconsistencies associated with 
laboratory testing. Most serological assays for select agents are not 
commonly conducted in clinical laboratories and are primarily 
performed in research laboratories. As such, these assays may not be 
properly controlled and validated. Assay-to-assay variation may be 
high, especially if experience is limited. Additionally, such assays are 
not particularly robust unless baseline specimens are available for 
comparison testing and serum samples are collected within relatively 
short time frames (for example, 3 to 6 months). 

7. We agree with HHS that national goals may change over time. 
Therefore, it is important that the strategic evaluation of high- 
containment laboratories be undertaken periodically. We have 
modified our recommendation to include periodic evaluation. 

8. Our report recommends that a single entity be charged with 
governmentwide strategic evaluation of high-containment laboratories. 
While we agree that there are several challenges, having a single 
agency would facilitate a coordinated response. 

9. We agree that future evaluations of laboratory capacity and supply 
should examine the needs of the clinical laboratories related to their 
high-containment capacity. However, knowing the number of 
laboratories is a key requirement to making such evaluation effective. 

10. We disagree. We believe that national standards contribute to ensuring 
that all high-containment laboratories meet minimum standards. 
National standards are valuable not only in relation to new laboratory 
construction but also in ensuring compliance for periodic upgrades. 
We agree that BMBL provides guidance on design and construction; 
however, the guidance does not provide standards that must be 
adhered to. While sharing lessons learned can be beneficial to meeting 
standards, it is not an adequate substitute for the standards themselves. 
If existing laboratories do not meet national standards, we believe that 
these laboratories need to be brought into compliance. 
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USDA 




United States Department of Agriculture 

Office of the Secretary 
Washington, D.C. 20250 



AUG 1 9 2009 



Dr. Sushil Sharma, Assistant Director 
Applied Research and Methods 
Center for Technology and Engineering 
U.S. Government Accountability Office 
441 G Street, NW 
Washington, DC 20548 

Dear Dr. Sharma: 

The U.S. Department of Agriculture (USDA) appreciates the opportunity to review and provide 
comments on the GAO Draft Report, "High Containment Laboratories: Coordinated National 
Oversight Is Needed" (09-574). We have addressed the Recommendations for Executive Action 
that pertain to USDA. 

GAO Recommendation 

We recommend that the National Security Advisor, in consultation with the Secretaries of 
Health and Human Services, Agriculture, Defense, and Homeland Security; the National 
Intelligence Council; and other executive departments as deemed appropriate identify a 
single entity charged with governmentwide strategic evaluation of high-containment labs 
that will (1) determine the number, location, and mission of the labs needed to effectively 
meet national goals to counter biothreats; the existing capacity within the United States; 
the aggregate risks associated with the labs' expansion; and the type of oversight needed; 
and (2) develop, in consultation with the scientific community, national standards for the 
design, construction, commissioning, and operation of high-containment labs, specifically 
including provisions for long-term maintenance. 

USDA Response 

USDA agrees with this Recommendation, and will work with the National Security Advisor and 
other agencies to determine the appropriate body that should be charged with governmentwide 
strategic evaluation for high-containment labs. Further, USDA will also work cooperatively on 
establishing national standards for the design, construction, commissioning, and operation of 
high-containment laboratories. 



An Equal Opportunity Employer 
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Two interdepartmental work groups have also reviewed issues related to oversight of high- and 
maximum-containment laboratories. The Trans-Federal Task Force on Optimizing Biosafety 
and Biocontaiment Oversight (co-chaired by USDA and the Department of Health and Human 
Services (HHS)) focused its evaluation on Federal facilities, while the Biosecurity Working 
Group (formed in response to Executive Order 13486, "Strengthening Laboratory Biosecurity in 
the United States,") focused on security and personnel reliability for Federal, State, and private 
facilities. The Trans-Federal Task Force, and the Biosecurity Working Group will be submitting 
their recommendations to Congress and the White House on similar issues. The 
recommendations submitted from these evaluations may affect the scope of work discussed in 
these GAO recommendations. 

GAP Recommendation 

We recommend that the Secretaries of Health and Human Services and Agriculture 
develop (1) a clear definition of exposure to select agents and (2) a mechanism for sharing 
lessons learned from reported lab accidents so that best practices for other operators of 
high-containments labs can be identified. 

USDA Response 

USDA agrees with this Recommendation. However, USDA believes that the Federal Select 
Agent Program (i.e., HHS' Centers for Disease Control and Prevention's (CDC) Division of 
Select Agents and Toxins, and USDA's Animal and Plant Health Inspection Service's (APHIS) 
Agriculture Select Agent Program) has provided a sufficiently clear definition of occupational 
exposure: "any event which results in any persons in a registered entity, facility or lab not being 
appropriately protected in the presence of an agent or toxin. This may include reasonably 
anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potential 
infectious materials that may result from the performance of a person's duties. For example, a 
sharps injury from a needle being used in select agent or toxin work would be considered an 
occupational exposure." This definition is derived from the Occupational Safety and Health 
Administration Bloodborne Pathogens Standard in title 29, Code of Federal Regulations (29 
CFR), part 1910-1030b) and is jointly published in the "Select Agents and Toxins Theft, Loss 
and Release Information Document," dated January 1 8, 2008. The document is currently posted 
on the Federal Select Agent Web site. 

USDA agrees with GAO that reported laboratory incidents can be summarized and published in 
a format that can help other entities learn from the incidents. USDA's APHIS will work with 
CDC to develop and complete an effective process, by December 2010. 
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GAP Recommendation 

Should the Secretaries consider implementing a personnel reliability program for high- 
containment labs to deal with insider risk, we recommend that they evaluate and document 
the cost and impact of such a program. 

USDA Response 

USDA agrees with this Recommendation. Should the Secretary of USDA consider 
implementing a personnel reliability program as part of our regulatory responsibilities, we will 
evaluate and document the cost and impact of such a program. The Biosecurity Working Group 
will address the issue of implementing personnel reliability programs in high-containment 
laboratories, and will provide additional information and possible recommendations on personnel 
reliability programs to be implemented in registered facilities. 

Further, USDA currently has a personnel reliability program for its own laboratories, as outlined 
in "USDA Departmental Manual 9610-001: USDA Security Policies and Procedures for 
Biosafety Level - 3 Facilities," which sets the policy on suitability requirements for USDA and 
non-USDA personnel requiring access to BSL-3 facilities. This document will soon be revised. 
However, as stated before, should USDA implement a new personnel reliability program, the 
agency will consider the cost and impact of such a program. 

GAP Recommendation 

Recognizing that biological agent inventories cannot be completely controlled at present, 
we also recommend that the Secretaries of Health and Human Services and Agriculture 
review existing inventory control systems and invest in and develop appropriate 
technologies to minimize the potential for insider misuse of biological agents. 

USDA Response 

USDA agrees with this Recommendation, and will review inventory control systems used by 
regulated laboratories and other laboratories working with pathogens. The Biosecurity Working 
Group has addressed inventory control systems in its review, and its report will probably include 
some recommendations on this issue. USDA and HHS will review existing inventory control 
systems within the context of the Federal Select Agent Program by December 2010 and will 
decide, by December 201 1, whether to change existing regulations. 

Pertinent to the issue of inventory control, the Federal Select Agent Program has developed a 
guidance document on long-term storage. This document, "Guidance on the Definition of Long 
Term Storage as Used in the Select Agent Regulations," is posted on the Federal Select Agent 
Program Web site. Based on comments from multiple public meetings, the document will be 
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expanded to include more specific guidance on working stocks, inventory procedures, and 
examples of inventory systems. We will have this guidance updated by December 2010. 



Sincerely, 



Ann Wright v_y 
Deputy Under Secretary 
Marketing and Regulatory Programs 
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